The Cyber Toolchain — issue -007, December 31, 2025
THE CYBER TOOLCHAIN
NO. -007
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED DECEMBER 31, 2025 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
ADScan v3.1.4 adds non-root execution default, --fix flag to check, and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.->DNS TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. fallback
└──▷ GET THIS VERSION
$ git clone --branch v3.1.4 https://github.com/ADScanPro/adscan.git
# already have the repo? check out this version:$ git checkout v3.1.4
└──▷ USE IT
Automatically attempt to repair detected configuration or dependency issues during a check run
shell
adscan check --fix
Adds --fix parameter to the check command to automatically fix detected issues
Adds DNS UDP→TCP fallback mechanism for improved network resilience
ADscan now exits when apt update fails instead of warning
3 details in Everything
└──▷ BREAKING ON UPGRADE
!apt update errors now stop the process instead of warning
2 more releases in this issue
· 2025-12-01 → 2025-12-23
ADscan v3.1.0 adds automatic credential extraction from SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. descriptions and PSTranscripts, plus password-spraying re-use workflow
└──▷ GET THIS VERSION
$ git clone --branch v3.1.0 https://github.com/ADScanPro/adscan.git
# already have the repo? check out this version:$ git checkout v3.1.0
Adds --extract-smb-desc flag to automatically extract credentials from SMB share descriptions (including null session contexts)
Adds interactive prompt/flow to re-run password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password. with discovered passwords to identify additional users
ADScan v3.0.1 adds CI command, BloodHound-first enumeration, and automated credential extraction
└──▷ GET THIS VERSION
$ git clone --branch v3.0.1 https://github.com/ADScanPro/adscan.git
# already have the repo? check out this version:$ git checkout v3.0.1
Adds new ci subcommand to run ADscan in CI pipelines with dedicated flags for automation
Changes group enumeration default strategy to BloodHound-first with LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. fallback for more consistent data
Enables automatic password extraction from spidering results and search descriptions when credential-like content is detected
Empire v6.3.0 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. agent support, ChaCha20-Poly1305 routing encryption, multi-language PSexec payloads, and customizable C# obfuscation.
└──▷ GET THIS VERSION
$ git clone --branch v6.3.0 https://github.com/BC-SECURITY/Empire.git
# already have the repo? check out this version:$ git checkout v6.3.0
└──▷ HOW TO FIND IT
Select a Go agent payload instead of PowerShell when laterally moving with PSexec, useful for evading PowerShell-focused defenses.
📍In the Empire client, when configuring the PSexec module, set the Language option to go to generate a Go-based Empire payload instead of the default PowerShell one.
Adds mTLS support to agents and listeners for mutual certificate-based authentication.
Upgrades routing packet encryption from RC4 to ChaCha20-Poly1305 for authenticated encryption.
Exposes all agent language options (C#, IronPython, Go, PowerShell) in PSexec payload selection.
Adds customizable C# obfuscation via ConfuserEx XML config through EmpireCompiler v0.4.1.
Supports overriding all Empire config values with environment variables.
+3 moreshow less
Changes PowerShell agent key exchange from RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. to Diffie-Hellman.
Moves default bypasses from individual stagers/modules into centralized config.
Allows the HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.host value to be used on HTTP and malleable listeners without requiring a cert path.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!RC4 is no longer used to deliver routing packets to agents — agents and listeners must both be on v6.3.0 for the ChaCha20-Poly1305 encrypted routing to be compatible.
Metasploit Pro 4.22.9 adds ESC16 support, session re-running, MSSQL encryption, LoongArch64 payloads, and new NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent./WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. persistence modules.
AD CS MetaModule now supports ESC10ESC10A Windows Active Directory privilege-escalation vulnerability in certificate template and CA configuration abuse, allowing attackers to impersonate other accounts; tools use it to test PKI misconfigurations., ESC16, and ESC9ESC9A Windows Active Directory privilege-escalation technique exploiting certificate template configurations where the template lacks the security extension, allowing an attacker to abuse certificate enrollment to impersonate other accounts. certificate abuse chains
Adds the ability to re-run individual sessions using their previous configuration via the Pro interface
Adds a new NTLM relay module for relaying from SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. to MSSQL servers, opening an MSSQL session on success
Extends payload support to the LoongArch64 architecture with a new reboot payload
Enables sessions to MSSQL servers that require encryption by adding a new MsTds::Channel for TLS negotiation
+1 moreshow less
Adds a Windows persistence module targeting WSL, creating registry entries (Run, RunOnce) to run Linux payloads stored in WSL
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The auxiliary/scanner/ssh/ssh_login_pubkey module has been removed; functionality is now integrated into auxiliary/scanner/ssh/ssh_login
Adds Echo context-aware automation for Dradis to deploy a local LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for improving issue write-ups and summarizing scanner output
Adds Services section in Dradis Gateway portal to create questionnaires that can automatically generate new projects from responses
Adds Whitelabling capability allowing admins to set a custom logo and brand color visible throughout the Dradis UI
Adds Docker Hub deployment options for Dradis CE with a new command-line interface for remote server streamlining
Introduces Hera unified layout with main/secondary navigation bars and left/right sidebars replacing complex legacy navigation
+6 moreshow less
Adds Webhook support in Gateway to trigger automated actions on events like contributor requests or project completions
Adds CSV import capability to the Issue Library for bulk-uploading custom issues without manual copy/pasting
Adds Dradis OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. as a built-in multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. integration allowing QR code generation with standard authenticator apps
Adds Project QA overall states accessible in BI analytics to track project readiness across the instance
Adds instance-wide Audit Logging feature with CSV export capability for security and compliance accountability
Improves API by adding an endpoint for exporting/downloading reports and exposing Node Properties on the Node endpoint
user-scanner v1.0.10 adds HackerNews, Substack, Lichess validations and auto-update via persistent config
└──▷ GET THIS VERSION
$ git clone --branch v1.0.10.0 https://github.com/kaifcodec/user-scanner.git
# already have the repo? check out this version:$ git checkout v1.0.10.0
add: hackernews username validation in community category
add: substack username validation in creator category
add: lichess username validation in gaming category using autocomplete api
Adds a runtime version checker that compares the local version against the latest release on PyPI, allowing users to update, skip, or permanently silence prompts via persistent configuration
Adds Bitbucket, SourceForge, Twitch, LeetCode, and itch.io platform modules for user availability checks
└──▷ GET THIS VERSION
$ git clone --branch v1.0.9.1 https://github.com/kaifcodec/user-scanner.git
# already have the repo? check out this version:$ git checkout v1.0.9.1
Twitch username validation support added
LeetCode module added in dev category with regex validation
itch_io module supports SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. verification and regex validation via a new Result class
waymore v7.1 adds /_incapsula_resource to default URL filters to exclude noisy Incapsula CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. responses
└──▷ GET THIS VERSION
$ git clone --branch v7.1 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v7.1
Adds /_incapsula_resource to FILTER_URL in config.yml and the built-in default constant, automatically excluding Incapsula CDN noise from results.
waymore v7.0 delivers 2-4x faster multi-source URL collection via async concurrent fetching across all six sources.
└──▷ GET THIS VERSION
$ git clone --branch v7.0 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v7.0
Adds async concurrent fetching across all six URL sources (Wayback Machine, Common Crawl, AlienVault OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure., URLScan, VirusTotal, Intelligence X) for 2-4x faster multi-source runs.
One source failure no longer halts others — concurrent error handling keeps remaining sources running.
Wayback Machine requests now use streaming (stream=True) so URLs collected before a dropped connection are saved rather than lost.
Adds per-source unique link counts in output, showing how many distinct URLs each source contributed.
Reduces memory usage by storing links in source-specific sets during processing and merging only at the end, clearing source sets immediately after.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Minimum Python version is now 3.7+ (required for async/await support); setups running Python 3.6 or earlier will break.
!The default value for -lcc/--limit-common-crawl is now 1 (previously unset/different), which may change Common Crawl result volume in existing scripts that relied on the old default.
!The default value for -p/--processes is now 2 (previously unset/different), which may change resource usage in environments that relied on the old default.
The httpx-toolkit probes HTTP services in parallel to identify live hosts, technologies, status codes, titles, and other web metadata.
httpx v1.7.3 adds a new host_ipJSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. field exposing the dialed/used IP address.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.3 https://github.com/projectdiscovery/httpx.git
# already have the repo? check out this version:$ git checkout v1.7.3
└──▷ TRY IT
Extract both the hostname and the actual dialed IP from scan results — useful when targets resolve to CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. or load-balanced IPs you want to track.
!The host JSON field now returns the hostname instead of the IP address — pipelines that relied on host for the resolved IP must switch to the new host_ip field.
xnLinkFinder v7.8 adds HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. file support, enabling link and parameter extraction from recorded browser sessions.
└──▷ GET THIS VERSION
$ git clone --branch v7.8 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v7.8
└──▷ TRY IT
Extract links and parameters from a recorded browser session exported as a HAR file — useful for mapping attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. from authenticated app traffic.
$ xnLinkFinder -i session.har
Supports HAR (HTTP Archive) files as input via -i, extracting links and parameters from both requests and responses.
xnLinkFinder v7.5 adds unicode/percent-encoded domain detection and intelligent chunking for large responses.
└──▷ GET THIS VERSION
$ git clone --branch v7.5 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v7.5
Supports unicode and percent-encoded characters in domain matching, catching domains like thisätest.com and this%C3%A4test.com.
Adds automatic content chunking for responses over 50KB, splitting into overlapping 40KB chunks with 5KB overlap to ensure complete link discovery without regex timeouts.
theHarvester 4.9.0 adds 12 new OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. sources including Hudson Rock, Brave, Bitbucket, and 10 new discovery modules, plus HackerTarget API key support.
└──▷ GET THIS VERSION
$ git clone --branch 4.9.0 https://github.com/laramies/theHarvester.git
# already have the repo? check out this version:$ git checkout 4.9.0
└──▷ USE IT
Authenticate HackerTarget queries at higher rate limits by adding your key to api-keys.yml before running.
yaml
# In api-keys.yml:
hackertarget:
key: YOUR_API_KEY_HERE
# Then run:
theHarvester -d example.com -b hackertarget
Adds Hudson Rock module for credential/breach intelligence gathering.
Adds Brave search as a new OSINT discovery source.
Adds Bitbucket module for code-repository-based reconnaissance.
Adds 10 new discovery modules addressing expanded target enumeration coverage.
Supports HackerTarget API key authentication via api-keys.yml, enabling authenticated (higher-rate) queries.
+1 moreshow less
Removes Bing and Shodan modules from the active source list.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Bing and Shodan modules have been removed; any scripts or workflows specifying -s bing or -s shodan will no longer work.
Predatory ESP32 firmware for M5Stack, Cardputer and LilyGo devices.
Bruce v1.13 adds LoRaLoRaA cheap fine-tuning method that trains small add-on weight matrices instead of the whole model. The result is a few-megabyte adapter that can be swapped in and out of the base model. chatting menu items and smarter handshake capture logic
└──▷ GET THIS VERSION
$ git clone --branch 1.13 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.13
└──▷ HOW TO FIND IT
Access the new LoRa chatting menu to send messages and adjust frequency.
📍In the main menu, select LoRa then Chatting. Use the on-screen keyboard to enter your username or change the frequency.
Adds LoRa keyboard chatting capabilities including username settings and frequency change controls
Improves capture_handshake logic to wait for usable EAPOL frames before proceeding
2 details in Everything
1 more release in this issue
· 2025-12-02 → 2025-12-24
Flipper Zero Unleashed Firmware, an unlocked alternative firmware.
Unleashed Firmware unlshd-084 adds experimental SubGHz counter modes and UI, Saflok MFUL parser support, and NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. performance improvements
└──▷ GET THIS VERSION
$ git clone --branch unlshd-084 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:$ git checkout unlshd-084
SubGHz: Adds Counter Edit option with UI for manual counter modification (requires Debug mode)
SubGHz: Adds UI for Counter Experimental Mode to switch counter behavior (requires Debug mode)
SubGHz: Adds support for Keeloq, CAME Atomo, Nice Flor S, and AlutechAT4N Counter modes
SubGHz: Adds new experimental counter overflow mode (OFEX) which resets counter values on overflow
SubGHz: Adds default remote and clear slot features for SubGHz Remote
+3 moreshow less
NFC: Adds MFUL counters to the Info page
NFC: MFKey 4.0 and MIFARE ClassicMIFARE ClassicA family of contactless smart card chips made by NXP, widely used in access control and transit systems, whose weak proprietary encryption makes it a frequent target for RFID analysis and cloning tools. Static Encrypted Nested attacks now run 10x faster
Apps: Enables use of keys found in key cache for NFC Nested attacks without clearing the cache first
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32.
ESP32 Marauder v1.9.0 adds Flock scanning/wardriving, MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. CLI commands, and ESP32-C5 5GHz packet injection.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.0 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:$ git checkout v1.9.0
Add Flock penguin battery scanner capability via the /wiki/flock-sniff wiki page
Add Flock WiFi sniffing capability via the /wiki/flock-sniff wiki page
Add MAC Address CLI commands for interacting with hardware MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet.
Add Flock wardriving capability via the /wiki/flock-wardrive wiki page
Add Bluetooth support on C5 hardware
+1 moreshow less
Add 5ghz channels support for packet injection on C5 hardware
WiFi Pineapple Pager 1.0.2 adds configuration wizard for Evil WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes. settings
Convert Evil WPA configuration to a configuration wizard and add encryption type to options
The firmware for the HackRF+PortaPack H1/H2/H4/H4M.
Mayhem v2.3.2 adds FLEX pager app, SSTV RX application and Sonde map support
└──▷ GET THIS VERSION
$ git clone --branch v2.3.2 https://github.com/portapack-mayhem/mayhem-firmware.git
# already have the repo? check out this version:$ git checkout v2.3.2
Adds FLEX pager application for receiving FLEX protocol pagers
The open-source wireless research platform for ESP32.
GhostESP v1.9 adds Ethernet, AirTag RSSI logging, IR CLI, drone detection, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. parser compat and more
└──▷ GET THIS VERSION
$ git clone --branch v1.9 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:$ git checkout v1.9
Adds ghostlink split-view terminal with peer response logs in the display UI
Adds Invert Encoder setting to display UI for configs with encoders
Adds wired screen mirroring support
Adds first time boot setup wizard for display enabled configs
Adds Flipper Zero NFC parser compatibility layer with support for Aime, CSC Service Works, WashCity, Metromoney, Bip, CharlieCard, Disney Infinity, HI!, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. PACS, H World, Kazan, Microel, MiZIP, Plantain, Saflok, Skylanders, SmartRider, Social Moscow, Troika, Two Cities, Umarsh, Zolotaya Korona, and Zolotaya Korona Online
+21 moreshow less
Adds basic Mifare Desfire detection
Adds AirTag RSSI update logging so existing tags report RSSI changes every few seconds
Adds GATT scanning, service scanning and RSSI tracking
Adds Ethernet support and docs
Adds Ethernet Fingerprint scanning
Adds Unique AP counter to wardriving summary
Adds a Sweep scan to capture WiFi, BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems., GPS and 802154 data in a csv file on SD
Adds RSSI tracking for selected APs and stations
Adds OUI vendor lookup for access points and stations
Adds drone detection and spoofing
Adds IR CLI support
Adds IR Dazzler functionality to pulse IR at 38kHz 95% duty load
Adds CLI commands for changing the status display animations
Adds command to set amount of RGB LEDs
Adds SD Card CLI for control via WebSerial File Browser
Adds JTAGJTAGA hardware debugging standard (IEEE 1149.1) that exposes a chip's internal state through a small set of pins, letting cyber tools read memory, set breakpoints, and flash firmware without touching the running OS. support for ESP32C5
Adds USB HID keyboard host support on ESP32-S3 devices for controlling the UI and inputting text
Adds gpspin command to set the GPS pin for recieving data
Adds support for the RabbitLabs Poltergeist board
Adds basic support for the Heltec v3 (NO LORA/MESH)
Add Docker support for HTML header generation with build script
Feature-rich, stable and customizable Flipper Zero firmware.
Momentum mntm-012 adds MIFARE Ultralight CMIFARE Ultralight CA low-cost NXP contactless smart card IC using ISO 14443-A at 13.56 MHz, adding 3DES authentication over the original Ultralight; tools use it to read, clone, or audit access-control tokens built on this chip. dictionary attacks, 10x faster Static Encrypted Nested NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. attacks, FeliCaFeliCaA contactless smart card standard developed by Sony, widely used in Japanese transit and payment systems, operating at 13.56 MHz with its own proprietary protocol distinct from ISO 14443. dump/emulation, new Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals. protocols, and dozens of new
└──▷ GET THIS VERSION
$ git clone --branch mntm-012 https://github.com/Next-Flip/Momentum-Firmware.git
# already have the repo? check out this version:$ git checkout mntm-012
Adds MIFARE Ultralight C dictionary attack using system and user dictionaries stored under /nfc/assets/, plus key management via Extra Actions → MIFARE Ultralight C Keys in the NFC app (add, list, remove keys).
Adds gui/button_menu, gui/button_panel, gui/menu, gui/number_input, gui/popup, and gui/vi_list modules to the JS GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. scripting layer.
Adds NFC CLI commands via OFW for scripting and automation from the command line.
Adds buzzer CLI command for programmatic buzzer control.
Adds MIFARE ClassicMIFARE ClassicA family of contactless smart card chips made by NXP, widely used in access control and transit systems, whose weak proprietary encryption makes it a frequent target for RFID analysis and cloning tools.Show Keys UI in the NFC app.
+34 moreshow less
Adds MFUL counters display to the NFC Info page.
Adds Saflok MFUL Parser support in the NFC app.
Adds Rename Option for BT Remote and simplifies the Bad KB BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. profile.
Adds Skip Sliding Animations option for the Lockscreen in MNTM Settings.
Adds Main Menu support for directories and generic files (including JS files) in MNTM Settings.
Adds Keybinds support for directories on the Desktop.
Adds Vibro Trigger option in Input Settings.
Adds Screen Settings shortcut to Control Center brightness click in the GUI.
Adds date/time input module to the OFW GUI layer.
Adds Colemak keyboard layout to Bad KB.
Supports opening and favoriting Picopass files in the Archive.
Supports writing Securakey, Jablotron, and FDX-B formats to EM4305 RFID cards.
Adds selectable mouse clicker button in BT Remote.
Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-3166 country names display for pet chips in RFID.
Adds new games and GPIOGPIOGeneral-Purpose Input/Output pins on a microcontroller or SoC that firmware can individually control as digital signals, letting cyber tools interact directly with hardware interfaces like UART, JTAG, or SPI./NFC/Sub-GHz/Tools/USB/Media apps including Ghost ESP (ESP32), FlipTDI (FTDI232H), INA Meter, FlipTelegram, FlipMap, CO2 Logger (MH-Z19), iButton Converter, Video Player, NFC-Eink, Simultaneous UHF RFID Reader, CAN Tools, USB-MIDI, and more.
Adds UL-C keys to the NFC MFUL dictionary.
39 details in Everything
└──▷ BREAKING ON UPGRADE
!JS module gui/submenu: the API now takes submenu items as view children instead of as a view prop — scripts using gui/submenu must be updated.
!JS module gui/widget: the button event now returns an object with key and type instead of just the key name — scripts using gui/widget must be updated.
BloodHound v8.4.0 adds an Auditor role, exposure values in Domain Selectors, Prometheus ingest metrics, and reworked Citrix CanRDP analysis.
└──▷ GET THIS VERSION
$ git clone --branch v8.4.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v8.4.0
Adds a new Auditor role for read-only audit access to the platform.
Adds exposure values to Domain Selectors for at-a-glance risk visibility.
Adds icons to the object count panel in Attack Graph Tool for faster object-type identification.
Adds Prometheus metrics for ingest throughput, enabling observability of data pipeline performance.
Exposes product edition in the VersionResponse API endpoint.
+7 moreshow less
Allows SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. admins to disable MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for individual users.
Adds environment filter capability to selector views.
Adds support for OR behavior across multi-filter conditions in selectors.
Reworks Citrix CanRDP analysis logic for more accurate privilege path detection.
Sets initial only as the default certification when using Quick Add to create a selector.
Enables analysis descriptions to be displayed in the UI.
Adds vulnerability scanning to the CI/CD pipeline.
evil-winrm 3.8 adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ccache/kirbi support with -K flag and persistent command history
└──▷ GET THIS VERSION
$ git clone --branch 3.8 https://github.com/Hackplayers/evil-winrm.git
# already have the repo? check out this version:$ git checkout 3.8
Adds -K flag to load Kerberos ticket files (ccache and kirbi formats) with automatic format detection/conversion and optional reverse DNS lookup for FQDN
Adds persistent command history per user/host, stored in ~/.evil-winrm/history/
Adds clear, cls commands and Ctrl+L support for clearing screen
$ git clone --branch v0.14.14 https://github.com/brightio/penelope.git
# already have the repo? check out this version:$ git checkout v0.14.14
└──▷ TRY IT
Listen on multiple ports at once to catch shells from targets configured with different callback ports.
$ penelope -l 4444 4445 4446
Adds pspy module for unprivileged process monitoring on target hosts.
Adds panix module for persistence mechanism deployment.
Adds traitor module for automated privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources..
New -O / --oscp-safe switch restricts penelope to techniques permitted in OSCP exam environments.
Enables listeners on multiple ports simultaneously.
+2 moreshow less
Adds interface filter on the payloads command to scope payload generation to a specific network interface.
Disables random suffix on uploads by default, producing predictable filenames on target.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!Random suffix on uploads is now disabled by default — uploads that previously relied on unique suffixed filenames will no longer get them unless explicitly re-enabled.
NetExec v1.5.0 adds 15+ new modules including BadSuccessor, AWS creds, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. sync, raw NTDS copy, and unauthenticated KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access..
└──▷ GET THIS VERSION
$ git clone --branch v1.5.0 https://github.com/Pennyw0rth/NetExec.git
# already have the repo? check out this version:$ git checkout v1.5.0
└──▷ TRY IT
Extract SAM/LSALSALocal Security Authority — a Windows subsystem that handles authentication, enforces local security policy, and stores credential material, making it a frequent target for credential-harvesting cyber tools./NTDS secrets by mounting the raw disk — useful when AV blocks registry hive access.
Hunt for credentials stored in the info attribute of Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. user objects.
New change-passwordSMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. module resets accounts stuck in STATUS_PASSWORD_MUST_CHANGE without lockout.
Upgraded schtask_as module now supports uploading and executing custom binaries with custom flags via scheduled tasks.
New recyclebin module spiders the Windows Recycle Bin for deleted files (e.g., credentials) that were not emptied.
New mssql > enable_cmdshell module to enable xp_cmdshell on MSSQL targets.
New eventlog_creds module extracts credentials from Windows event logs when process creation auditing is enabled.
+25 moreshow less
New BadSuccessorLDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. module checks for the BadSuccessor privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. condition.
BloodHound Community Edition (CE) ZIP collector now supported; legacy collector selectable via config.
--dc-list flag now enumerates DCs across trusted domains.
Built-in LDAP signing and channel binding requirements now displayed in the host banner (replacing the removed ldap checker module).
AS-REP roastingAS-REP roastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline. now works with anonymous LDAP logins (no credentials required).
Kerberoasting now supported using a no-pre-auth account — no valid credentials needed.
New SMB module extracts GPO-deployed privilege assignments.
New efsr_spray module added.
New AWS Credentials Finder module discovers AWS credentials on target hosts.
New SMB notepad module extracts contents of unsaved Notepad files.
New entra-id LDAP module finds the Entra ID (Azure AD Connect) sync server.
New Entra ID sync credentials extractor module dumps sync credentials from the discovered server.
New --taskkill option kills remote processes by name or PID.
Process filtering added to --tasklist for targeted process enumeration.
--qwinsta now supports filtering output for a specific user.
New get-info-users LDAP module queries the info attribute of user objects for embedded passwords.
New ldap > dump-computers module dumps computer objects via LDAP.
New raw-ntds-copy module mounts the disk and parses raw content to extract SAM, LSA, and NTDS secrets — bypasses AV blocks on registry hive access; also available for WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. and WINRM protocols.
Password Fine-Grained Policy (PSO) enumeration promoted from module to core LDAP feature.
LDAP parsing support added to the daclread module.
XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. Base Directory specification now supported for nxc configuration paths.
base_dn option added to the subnet module.
WCC module gains LLMNR check and improved NBTNS check.
slinky module now supports setting a custom LNK target path.
30 details in Everything
└──▷ BREAKING ON UPGRADE
!The --opsec flag has been removed (deprecation: remove the horrible opsec flag).
!The multiple-hosts option has been removed (Removing the horrible multiple hosts option).
Codacy Cloud Dec 2025 adds PR Reviewer, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export, AI Risk Hub, ignore reasons, and API endpoint update
Adds PR Reviewer for contextual GitHub Pull Request reviews using security, duplication, complexity, and coverage metrics
Adds Ignore Reason field for ignored issues in repositories and the Security Dashboard (Accepted use, False positive, Not exploitable, Test code, External code)
Adds Export SBOM feature on the SRM Dependencies tab
Adds AI Risk Hub interface to evaluate risk of AI tool adoption
Updates dependencies list filters to support search by name, repositories, segments, severities, and license risk levels
+2 moreshow less
Replaces the deprecated getCodeBlock API endpoint with getFileContent (TAROT-3580)
Adds GolangCI-Lint 2.7.2 as a new supported tool
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The getCodeBlock API endpoint was deleted; use getFileContent instead (different path parameters)
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 25.11.2 adds PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0/MISRA compliance support, C++ gen 2 for new orgs, and enhanced analysis accuracy.
└──▷ HOW TO FIND IT
Check compliance status against new standards in reports.
📍View PCI DSS 4.0 and MISRA columns in the code findings table within Mend SAST UI.
Filter suppression requests by reason to speed up review workflows.
📍In the Suppression Requests view, use the filter dropdown to select false positive or acceptable risk.
Adds PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. DSS 4.0 and MISRA as supported compliance standards in code findings table and reports
Enables C++ gen 2 engine by default for newly created organizations
Adds filtering, sorting, and grouping of findings by project in the applications view
Improves accuracy of Java, JavaScript/TypeScript and Python analysis for CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-78, CWE-79 and CWE-89
Enhances support for Rust macros to ensure proper parsing of tainted data
+1 moreshow less
Adds ability to filter suppression requests by predefined reasons (false positive or acceptable risk) in the review UI
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Scans are now automatically stopped if the CLI cannot retrieve required engine configuration, which will interrupt scans on unreliable networks where this previously may have hung or produced inconsistent results.
3 more releases in this issue
· 2025-12-01 → 2025-12-15
Mend SAST adds PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0/MISRA compliance filters, C++ gen2 default for new orgs, and findings view enhancements.
PCI DSS 4.0 and MISRA standards are now visible in the code findings table and code reports for compliance filtering
Newly created organizations automatically have the C++ gen 2 engine enabled by default
Suppression request review now supports filtering by predefined reasons: false positive or acceptable risk
The applications view adds the ability to filter, sort, and group findings by project
Mend SAST v25.11.1 adds batched findings for Agentic detection and expands low-probability taint sources for Rust/C++.
Agentic SAST detection now reports all detected findings in the generated code at once instead of just one finding per invocation.
Added low probability taint sources for file, database, console, and environment variable reads in Rust.
Reclassified CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-242: Use of Inherently Dangerous Function and CWE-676: Use of Potentially Dangerous Function to low probability category for C/C++.
Added reading from local files as a low probability taint source.
Organizations are now sorted alphabetically in the Mend CLI’s organization selection step.
Mend SAST 25.11.1 adds batched Agentic SAST findings, expanded low-prob taint sources for Rust and C/C++, and sorted org selection in CLI
Agentic SAST detection now reports all detected findings in the generated code at once instead of just one finding per invocation
Added low probability taint sources for file, database, console, and environment variable reads in Rust, improving analysis accuracy
Reading from local files has been added as a low probability taint source
Reclassified CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-242: Use of Inherently Dangerous Function and CWE-676: Use of Potentially Dangerous Function to low probability category for C/C++, enhancing scan accuracy when scanning with the default configuration
Further improved detection accuracy for C/C++ gen 2 , most notably for the following CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes.: CWE-121: Buffer Overflow CWE-369: Divide by Zero CWE-606: Loop Denial of Service CWE-611: XML External Entity (XXEXXEXML External Entity injection, a class of attack against XML parsers that tricks them into fetching external resources or local files, letting an attacker read sensitive data or trigger server-side request forgery.) Injection CWE-789: Uncontrolled Memory Allocation
+1 moreshow less
Organizations are now sorted alphabetically in the Mend CLI’s organization selection step, making it easier and faster to navigate large lists
pip-audit v2.10.0 adds a custom OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. service URL flag and Ecosyste.ms as a new vulnerability source.
└──▷ GET THIS VERSION
$ git clone --branch v2.10.0 https://github.com/pypa/pip-audit.git
# already have the repo? check out this version:$ git checkout v2.10.0
└──▷ TRY IT
Audit a project against an internal OSV mirror — useful when your org runs an air-gapped or custom OSV instance.
KICS v2.1.18 adds ~30 new Terraform queries for Azure/GCP compliance and optimizes engine performance with directory caching.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.18 https://github.com/Checkmarx/kics.git
# already have the repo? check out this version:$ git checkout v2.1.18
Optimizes the Terraform parser with directory caching and LOC-based memory calculation to improve scan performance on large IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. repositories
Adds Beta - Activity Log Alert For Create Policy Assignment Not Configured query for Terraform/Azure
Adds Beta - Activity Log Alert For Delete Policy Assignment Not Configured query for Terraform/Azure
Adds ensure critical contacts is configured for organization query for Terraform/GCP
Adds Beta - Activity Log Alert For Create Or Update Network Security Group Not Configured query for Terraform/Azure
+35 moreshow less
Adds Beta - Activity Log Alert For Delete Network Security Group Not Configured query for Terraform/Azure
Adds Beta - Activity Log Alert For Create or Update Security Solution Not Configured query for Terraform/Azure
Adds Beta - Activity Log Alert For Delete Security Solution Not Configured query for Terraform/Azure
Adds Beta - Activity Log Alert For Create or Update SQL Server Firewall Rule Not Configured query for Terraform/Azure
Adds Beta - Activity Log Alert For Delete SQL Server Firewall Rule Not Configured query for Terraform/Azure
Adds Beta - Activity Log Alert For Create or Update Public IP Address Rule Not Configured query for Terraform/Azure
Adds Beta - Activity Log Alert For Delete Public IP Address Rule Not Configured query for Terraform/Azure
Adds Beta - File Share Without Soft Delete query for Terraform/Azure
Adds Beta - Storage Account Not Using Latest SMB Protocol Version query for Terraform/Azure
Adds Beta - Storage Account Using Unsafe SMB Channel Encryption query for Terraform/Azure
Adds Beta - Blob Storage Without Soft Delete query for Terraform/Azure
Adds Beta - Storage Account With Shared Access Key query for Terraform/Azure
Adds Beta - Containers Without Soft Delete query for Terraform/Azure
Adds Beta - Storage Account With Cross Tenant Replication Enabled query for Terraform/Azure
Adds Beta - Storage Account Without Delete Lock query for Terraform/Azure
Adds Beta - Activity Log Alert For Service Health Not Configured query for Terraform/Azure
Adds Beta - Service Without Resource Logging query for Terraform/Azure
Adds new query "Beta - Databricks Workspace Without CMK" for Terraform/Azure
Adds Beta - Logs And Alerts Missing Project Ownership Assignment And Changes query for Terraform/Azure
Adds Beta - Logs And Alerts Missing Audit Configuration Changes query for Terraform/Azure
Adds Beta - Logs And Alerts Missing Custom Role Changes query for Terraform/GCP
Adds Beta - Resource Without Diagnostic Settings query for Terraform/Azure
Adds Beta - Diagnostic Settings Without Appropriate Logging query for Terraform/Azure
Adds Beta - Databricks Diagnostic Logging Unconfigured query for Terraform/Azure
Adds Beta - Cloud Asset Inventory Disabled query for Terraform/GCP
Adds ensure Legacy Networks Do Not Exist For Older Project query for Terraform/GCP
Adds Beta - Backup Vault Without Soft Delete query for Terraform/Azure
Adds Beta - Backup Vault Without Immutability query for Terraform/Azure
Adds Beta - Recovery Services Vault Without Soft Delete query for Terraform/Azure
Adds query checking user access administrator is not restricted for Terraform/Azure
Adds Beta - Recovery Services Vault Without Immutability query for Terraform/Azure
Adds Beta - Recovery Services Vault With Public Network Access query for Terraform/Azure
Adds query Beta - Key Vault Purge Protection Is Enabled for Terraform/Azure
Adds Beta - VM Without Managed Disk query for Terraform/Azure
Adds Beta - SQL Database Without Data Encryption query for Terraform/Azure
40 details in Everything
1 more release in this issue
· 2025-12-02 → 2025-12-18
Adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client credentials flow support for Veracode integrations and APIs.
HawkScan 5.1.0 adds React2Shell RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. detection and fixes smart crawl path filtering
Enables fuzzing of endpoints discovered by the smart crawl plan via the active scanner
1 detail in Everything
1 more release in this issue
· 2025-12-13 → 2025-12-17
HawkScan 5.0 adds multi-profile business logic testing, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. smart crawl plans, and sensitive data detection plugins.
Adds multi-profile scanning for business logic testing, enabling automated detection of BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. and BFLABFLABroken Function Level Authorization, an API vulnerability class where an application fails to enforce access controls on specific endpoints, letting lower-privileged users call admin or restricted functions. vulnerabilities by configuring multiple authentication profiles
Adds a smart crawl plan that automatically generates crawling strategies based on configured OpenAPI specifications to understand API structure and data relationships
Adds new passive scan plugins for sensitive data exposure: Credit Card Numbers (100008), Email Addresses (100009), HTML Comments (100011), and IBAN Numbers (100012)
Adds evidence chains to BOLA and BFLA alerts showing cross-profile access attempts and responses
Improves OpenAPI support by merging multiple specification files into a unified API definition
Mend SCA v25.12.1 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import API 3.0 endpoint for automation.
Adds support for SBOM import via a new API 3.0 endpoint under the Application scope
Retrieves detailed import logs for improved automation and observability
2 details in Everything
1 more release in this issue
· 2025-12-14 → 2025-12-28
Mend SCA v25.11.2 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. API 3.0 import, Logs API, account-level Reports tab, and Jira integration for Legal workflows.
Added support for SBOM import through API 3.0
Added a dedicated logs API for enhanced traceability
Added a new Reports tab in the Accounts view for Inventory and Security Alerts reports
Legal and Compliance workflows now support Jira Issue creation
GitLab 18.7 adds secret validity checks, AI SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. false positive detection, CI/CD dynamic inputs, and more.
Adds report filtering by validity status to the Vulnerability Report for rapid triage of leaked secrets
Adds a group-level API to turn on secret validity checks across all projects in a group with a single call
Integrates secret validity checks with Google Cloud, AWS, and Postman vendor integrations
Enables separate model selection for Agentic Chat versus other agents for top-level groups or instances
Adds an endpoint for instance-level AI usage to extract all Duo data from Postgres or ClickHouse
+27 moreshow less
Provides 6-month trend analysis across GitLab Duo feature adoption, pipeline performance, and development metrics
Enables code generation volumes and IDE/language trends tracking in the GitLab Duo and SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after. trends dashboard
Introduces create and edit features for the Planner Agent in beta
Adds dynamic input options in CI/CD pipelines to enable cascading dropdowns in the web interface
Introduces AI-powered SAST False Positive Detection (Beta) for Critical and High severity vulnerabilities
Enables manual trigger option for false positive detection on individual vulnerability details pages
Adds a new security dashboard enabled by default on GitLab Dedicated and GitLab Self-Managed
Adds a risk score module to the new security dashboards that calculates estimated risk based on a GitLab algorithm
Adds an instance setting to control publishing of components to the CI/CD Catalog via an allowlist of authorized projects
Expands Advanced Search to return matching results from both merge request descriptions and comments
Adds support for the AGENTS.md specification in GitLab Duo Chat (Agentic) in IDEs
Pins AI agents and flows from the AI Catalog to a specific version when enabled in a project
Adds an AI gateway timeout setting configurable from 60 to 600 seconds for self-hosted models
Allows reporting of agents and flows to instance administrators via an abuse report mechanism
Enables configuring foundational agent availability by turning them on/off or toggling individual agents
Enhances active trial experience for Self-Managed users with status, remaining days, and expiration notifications in the left sidebar
Adds grouping data by OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. 2021 categories to the vulnerability report
Adds filtering by vulnerability identifier, reachability value, and policy violation bypass reason to the vulnerability report
Introduces a Data Analyst foundational agent powered by GLQL in beta
Adds filtering by status, project, and control to compliance violations reports, plus collaboration via comments
Changes compliance framework controls to show scan success/failure based solely on scan completion rather than overall pipeline status
Adds warn mode to merge request approval policies allowing non-blocking bot comments during policy rollout
Enables using the API to query a filtered list of policy violations on the default branch in a project
Makes service accounts available during trials on GitLab.com for Silver and Gold tiers
Configures task scaler reservation throttling in GitLab Runner 18.7
Enables FF_TIMESTAMPS by default in GitLab Runner 18.7
Adds Windows 11 2025 (25H2) support in GitLab Runner 18.7
32 details in Everything
└──▷ BREAKING ON UPGRADE
!Compliance framework controls now show scan success/failure based solely on scan completion, which may differ from the previous reliance on overall pipeline status.
noir v0.26.0 adds Postman, HTML, PowerShell output formats, new taggers, and expanded framework support
└──▷ GET THIS VERSION
$ git clone --branch v0.26.0 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:$ git checkout v0.26.0
└──▷ USE IT
Generate a Postman collection for import into your test environment.
shell
noir -f postman <url_or_file>
Create an HTML report for sharing with non-technical stakeholders.
shell
noir -f html <target>
Output commands to replay requests in PowerShell without external converters.
shell
noir -f powershell <target>
-f postman flag enables Postman Collection v2.1.0 output format
-f html flag enables HTML output format
-f powershell flag enables PowerShell Invoke-WebRequest output format
Added new GraphQL, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store., and FileUpload taggers for detecting specific request types
Expanded detector/analyzer support for Scala (Scalatra, Play, Akka), Swift (Vapor), TypeScript (NestJS), and C# ASP.NET Core MVC frameworks
Openlayer adds Google ADKADKGoogle's Agent Development Kit, an open-source framework for building and orchestrating AI agents; cyber tools use it to compose multi-agent workflows with built-in tool-calling and state management. integration, pausable tests in Monitoring mode, duplicate key checks, CLI export, Snowflake/remote support, and marketplace availability.
Adds openlayer test export CLI command to export tests for a project
Adds ability to pause test execution in Monitoring mode via the platform UI
Adds new integration with Google Agent Development Kit (ADK) for evaluating multi-agent systems
Adds new platform test type to check for duplicate unique and primary keys
Adds support connecting to Snowflake views and running tests via remote execution
+5 moreshow less
Adds ability to run custom SQL tests joining multiple tables
Adds OPENLAYER_CERTS environment variables (or equivalent config) to specify custom certs for external services
Adds Azure managed identity support for storage connections in On-Prem deployments
Makes Openlayer available on AWS, Azure, and Google Cloud marketplaces
Adds ability to assign static IPs to Openlayer servers for allowlisting
AFL++ v4.35c adds GUIFuzz++ for desktop GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. fuzzing and IJON support in QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. mode
└──▷ GET THIS VERSION
$ git clone --branch v4.35c https://github.com/AFLplusplus/AFLplusplus.git
# already have the repo? check out this version:$ git checkout v4.35c
Adds GUIFuzz++ integration, enabling grey-box fuzzing of desktop graphical user interfacegraphical user interfaceA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. applications.
Adds IJON support in qemu_mode for enhanced coverage-guided feedback in binary-only targets.
Adds complete hidden decision coverage to default pcguard instrumentation in afl-cc.
Adds complete hidden decision coverage to LTO instrumentation in afl-cc.
Mend Platform 25.12.1 adds AI-powered natural language search and enhanced SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integration controls
Adds a natural language search bar powered by AI to filter applications and projects with intuitive prompts.
Enhances SAML integration with new configuration options, improved user provisioning controls, and a modernized UI for a more flexible and secure authentication experience.
Enables disabling local logins within the SAML configuration.
Adds Aikido MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. for agent code analysis, Azure Management Group auto-discovery, and GraphQL to AI Pentest
Adds Aikido MCP to let AI agents analyze code security risks locally without sending data to the cloud
Adds re-testing capability for individual AI Pentest findings to verify fixes without a full pentest run
Adds Azure Management Group support to automatically discover all groups and subscriptions in a single connection
Wallarm Security Edge adds custom block pages, ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. for IP-based access control, and content caching rules.
Adds the ability to configure custom block pages returned alongside the 403 response for blocked malicious activity
Adds support for creating and managing Access Control Lists (ACLs) to define which IP addresses can access specific hosts and locations of APIs
Adds support for content caching rules defining how Inline nodes store and reuse responses from specific hosts and locations
JavaScript SDK 3.38.0 adds NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. inspect API support and larger config store buffers.
inspect module gains support for the NGWAF inspect API (#1212)
Config store now supports buffers longer than 8k bytes (#1181)
2 details in Everything
4 more releases in this issue
· 2025-12-09 → 2025-12-18
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. introduces APIs for creating and managing custom and default security dashboards
Adds the Custom dashboards API to create, manage, and customize dashboards for visualizing security metrics in Next-Gen WAF
Enables configuration of workspace default dashboards via the new API
New ngwaf_bot_analysis_request_count field available in Fastly NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. APIs
cside enterprise adds self-service SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. setup for Okta, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., and Duo via dashboard
└──▷ HOW TO FIND IT
Onboard an enterprise identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. without opening a support ticket
📍In the cside dashboard, navigate to Settings › Identity Provider and select Okta, Microsoft Entra ID, or Duo Security.
v0.154.5 adds MongoDB secret rotation, global approvals v1, and AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege.PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. support
└──▷ GET THIS VERSION
$ git clone --branch v0.154.5 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.154.5
Adds secret-rotation integration for MongoDB app connections and automated secret rotation
Introduces global approvals v1 feature allowing cross-project permission requests
Adds AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. PAM support to the Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. system
Adds external CA support on PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. and an export-assets script for CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server..
└──▷ GET THIS VERSION
$ git clone --branch v0.154.4 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.154.4
Adds external CA support on PKI to issue certificates via external certificate authorities
Adds export-assets script to package assets for CDN distribution
Adds expiring SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. token notifications and switches SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. to user alias verification
└──▷ GET THIS VERSION
$ git clone --branch v0.154.3 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.154.3
feat: Adds expiring SCIM token notification feature to alert users before their tokens expire.
feat: Switches the SAML authentication flow from certificate-based checks to user alias verification method.
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.92.4 adds line numbers for GitHub real-time scanning and role-aware resumption for legacy S3 scans.
└──▷ GET THIS VERSION
$ git clone --branch v3.92.4 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.92.4
Adds line numbers to GitHub real-time scan findings for precise secret location reporting.
Supports role-aware resumption for legacy S3 scans, enabling interrupted scans to resume correctly when assuming IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles.
Adds pagination and rate-limit handling for Docker Registry namespace API calls, improving reliability at scale.
3 details in Everything
4 more releases in this issue
· 2025-12-02 → 2025-12-19
New Cloudflare R2 and Azure SAS URL detectors, MySQL assignment detector, and Tailscale SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. key checker added in Detection Engine 2.154.
Cloudflare R2 Token detector adds support for detecting Cloudflare R2 authentication tokens
Azure SAS URL detector adds support for detecting Azure Shared Access Signature URLs
MySQL Credentials detector now uses a new assignment detection mode that excludes port-based matching
Adds a checker for Tailscale SCIM keys.
4 details in Everything
1 more release in this issue
· 2025-12-05 → 2025-12-15
Detection Engine 2.153 adds 6 new detectors, 883 secret providers and improves recall for MySQL and GitLab tokens.
Adds detectors for HighLevel Private Integration Token, Elastic API Key, Google Cloud Keys (base64), Socket Dev API Key, Upstash Redis Credentials, and Vapid Key
Adds a new checker for Oracle credentials
Adds support for 883 new secret providers to improve incident prioritization on generic secrets
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The aws_iam analyzer is removed; AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. scope analysis is now performed by NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. integration with AWS
Release expands non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) governance capabilities by enabling enumeration of service accounts and API keys across four critical infrastructure platforms: Datadog, Snowflake, Okta, and Auth0.
4 more releases in this issue
· 2025-12-12 → 2025-12-31
New Analytics Overview dashboard for executives with unified KPIs and trend visualizations
Adds Analytics > Overview page providing a unified KPI strip for Protect, Detect, Remediate, and Govern metrics including repository coverage, incident volume, remediation speed, and identity safeguards.
Enables visualization of monitored perimeter trends showing how repository count evolves week over week.
Introduces Top Risky Data Sources view to identify repositories generating the most critical and high-severity incidents.
Adds Critical Incident Trajectories chart to track incident volume changes over time.
Displays Most Common Secret Types breakdown to understand frequently appearing secret categories in the perimeter.
+2 moreshow less
Provides Closure Progress metrics monitoring auto-closures and manual resolutions for remediation performance.
Surfaces Governance Signals view showing vaulted secrets and breached policies for NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. governance insights.
GitGuardian SaaS adds NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. discovery for Airbyte, Anthropic, and more; incidents API date filtering
└──▷ HOW TO FIND IT
Connect a new Airbyte workspace to expand NHI discovery coverage.
📍Navigate to Settings › Integrations › Sources › NHI Governance and connect your Airbyte, Anthropic, N8n, OpenAI, CyberArk Secrets Manager Self Hosted, or Slack workspace.
Adds Identity Discovery for Airbyte, Anthropic, N8n, OpenAI, CyberArk Secrets Manager Self Hosted, and Slack via Settings > Integrations > Sources > NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems.
Adds support for filtering incidents by triggered date in the public Incidents API endpoint
Adds Valid saved view to the Incidents Dashboard available for all accounts
GitGuardian 2025.12 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, CyberArk integration, in-app analytics beta, and multiple hostname support
Adds extra_hostnames Helm parameter to define additional domain names for self-hosted access
Adds SCIM team provisioning integration with Okta and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
Adds CyberArk Secrets Manager Self Hosted integration for non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. enumeration
Enables advanced analytics dashboards for secret leak monitoring when enabled via inAppAnalytics.enabled Helm value or KOTS Admin Console toggle
Adds support for Helm v4
+2 moreshow less
Adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support via the network.ipFamily parameter for Service resources
Adds global podDisruptionBudget.enabled Helm parameter to disable automatic PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis. creation
Nexus Repository 3.87 adds NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. Release Integrity via Firewall, new Configuration API, and OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs./JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auto-enablement.
Repository Firewall now provides Release Integrity protection for NuGet components
New Configuration API allows programmatic export/import of repository configuration and metadata migration between instances
OAuth2 realm is automatically enabled when nexus.jwt.enabled is set to true in Pro
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Java 21 is now the minimum required Java version; older versions will fail to run.
!AWS SDK for S3 blob stores upgraded from 1.x to 2.33.5, making non-AWS S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage (e.g., Dell) incompatible.
Adds --reach-use-only-pregenerated-sboms to restrict reachability analysis to pre-computed SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
Adds --reach-use-only-pregenerated-sboms flag to run Tier 1 reachability using only pre-computed CDX and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMs
Socket CLI 1.1.39 introduces a file output capability for the socket scan reach command via the --output flag and updates its underlying Coana CLI engine.
socket scan reach now supports the --output <path> flag (e.g., --output scan-report.json) to write the scan result to a file
Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.
Apiiro introduces unified SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. deduplication, CVE pane with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. triage hints, and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4 support.
Adds automatic deduplication of vulnerability identifiers across multiple SCA vendors, consolidating them into a single view
Adds CVSS v4 support alongside existing CVSS v2 and v3 for severity scoring
2 details in Everything
4 more releases in this issue
· 2025-12-03 → 2025-12-24
New default OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. license policies and detailed license inventory views.
Adds ability to view complete license details including type, terms of use, and OSI/FSF approval for each dependency.
Adds detection for edge cases such as missing, unknown, or multi-license packages within the license inventory.
sbomify v0.20 adds custom domain routing for Trust Center pages and a streamlined onboarding wizard.
└──▷ GET THIS VERSION
$ git clone --branch v0.20 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.20
└──▷ HOW TO FIND IT
Configure a custom domain like trust.example.com for your workspace's public Trust Center pages.
📍Navigate to Workspace Settings › Branding, enter your CNAME in the Custom Domain field, and follow the DNS validation steps provided in the UI.
Adds CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin.-based custom domain support for public Trust Center pages
Adds a single-step SBOM identity onboarding wizard with automatic redirect on first login
Allows editing workspace names directly from the settings page
Implements database-backed token URLs for team invitations to replace previous methods
sbomify v0.19 adds CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema./1.7 support, custom domains, and vulnerability scanning dashboard.
└──▷ GET THIS VERSION
$ git clone --branch v0.19 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.19
released_at field for release date tracking
Global Components - Workspace-level reusable components
Contact Profiles - Reusable supplier information for SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
Xygeni 5.36 adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. ingestion, mobile SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., IntelliJ plugin, and exploit-intel prioritization
Adds DAST ingestion capabilities to the vulnerability intake pipeline
Extends SAST coverage to mobile languages for static analysis
Spectra Assure Community 2025-12-18 adds Google/GitHub SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for Community accounts
ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. note cataloger now captures the OS field from ELF notes.
Invicti 20251204 adds API spec URL loading, bulk comments/tags, dark mode, and auto-scalable agents.
Adds URL reference support in target settings to load API specs at runtime from targets not accessible to Invicti cloud services
Enables adding bulk comments and tags to vulnerabilities
Adds Dark mode UI theme
Introduces Auto-scalable agents for scan infrastructure
Adds preview capability for REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. specifications (OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., Swagger, RAML) after upload
+1 moreshow less
Reports WAFs detected by DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scanner in the Scan activity log
nuclei v3.6.0 adds OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. direct fuzzing, multi-port JS templates, .NET DSL helpers, and a persistent metadata cache.
└──▷ GET THIS VERSION
$ git clone --branch v3.6.0 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.6.0
Adds direct fuzzing against a target URL using OpenAPI/Swagger specs, enabling spec-driven fuzz scanning without manual template authoring.
Supports multi-port targeting in JavaScript templates, allowing a single JS template to probe multiple ports on a host.
Expands the DSL with .NET deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. helper functions for crafting and evaluating deserialization payloads in templates.
Adds a persistent metadata cache in the template loader, speeding up repeated template loading across runs.
Adds a flag to specify a custom resume file path, giving practitioners control over where scan state is written.
ZAP 2.17 adds Insights tab for non-vulnerability metrics and systemic alert flagging to reduce duplicates.
Adds an Insights tab showing key application and scan effectiveness information in the ZAP Desktop UI.
Flags site-wide alerts as Systemic in the Desktop UI and reports.
Introduces the createdISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 date field in structured JSON and XML reports.
Stops persisting Active Scan temporary HTTP messages by default in headless mode, with an option also available in the Desktop.
Use the new tamper script to bypass case-sensitive WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. rules by randomizing command casing.
New component replacement workflow enables safe SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. updates with preview, dependency preservation, and revert capabilities.
Adds Component Replacement functionality to replace components in project versions while preserving dependency relationships
Adds Preview Before Replace capability to inspect metadata (supplier, homepage, license, release date) prior to confirmation
Adds Revert Replacements capability to remove a replacement and restore the original component
Adds Version Propagation to automatically propagate replacement relationships when creating new project versions
Adds Audit Trail tracking for all replacement and revert operations with user, timestamp, and comments in event history
ImHex v1.38.0 adds SSH/UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. data sources, save-editor mode, Yara jump-to-match, new data inspector rows, and a Markdown renderer.
└──▷ GET THIS VERSION
$ git clone --branch v1.38.0 https://github.com/WerWolv/ImHex.git
# already have the repo? check out this version:$ git checkout v1.38.0
New UDP Provider displays live UDP packets received on a specified port in the hex editor.
New SSH Provider connects to remote machines over SSH or SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. — enabling live RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. inspection via /dev/mem on remote hosts.
New Save Editor Mode: patterns marked with [[hex::editor_export]] surface in a simplified editor tab; launchable via imhex --save-editor <pattern_file> or the web version with ?save-editor=<gist_id>.
New imhex --file-info <file_path> CLI option displays metadata and pattern-derived descriptions about a file without opening the full UI.
Pattern Editor gains semantic syntax highlighting for PatternLanguage, matching-bracket highlighting, live external editor sync, and auto-closing parentheses/quotes.
+17 moreshow less
New Custom Encoding String, fp24, bfloat, and configurable fixed-point rows added to the Data Inspector.
New Go To command in the command palette for jumping to specific offsets.
New Decode as Encoding right-click option in the Hex Editor for decoding selected bytes with a chosen character encoding.
Clicking Yara matches now jumps to the corresponding location in the Hex Editor.
New Constants Search in the Find View replaces the Constants View — supports searching CRC polynomials and other predefined constants extensible via JSON files.
RGBA8 and RGB565 minimap visualizers added; minimap gains an option to shade cells by byte-value magnitude.
Markdown renderer added — used in the About changelog and Bookmark comments.
Region sidebar list added to Intel Hex and Motorola SREC providers.
Keyboard shortcuts added to jump to next/previous difference in the Diff View.
Interactive help button added to the title bar for context-sensitive UI element information.
Auto-updater now supports nightly builds and switching between stable and nightly channels.
New ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. builds available for Windows and Linux; new Snap and Flatpak packages for Linux.
Pattern Language: templates now support proper nesting and sensible scoping; conditionals support short-circuit evaluation; sizeof(SomeType) works with pointers.
Option to skip over large chunks of bytes with the same value added to the Hex Editor.
All tools and views are now accessible from the command palette.
Individual plugins can now be disabled from the Plugins settings page.
Startup time reduced from multiple seconds to ~60 ms; idle RAM usage reduced from 200 MB+ to ~60 MB.
22 details in Everything
└──▷ BREAKING ON UPGRADE
!Template parameter scoping in Pattern Language changed: parameters are now scoped to the template instantiation site rather than the usage site, so existing patterns using parent to work around the old scoping may need to be updated.
Frida 17.5.2 adds FridaCore Swift bindings via xcframework and improves Windows export accuracy.
Adds FridaCore Swift package with bindings for AuthenticationService, PortalService, EndpointParameters, PackageManager, and Compiler, plus minimal GLib bindings in a sub-namespace
Publishes frida-core releases as .xcframework files for direct integration into Xcode projects
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Swift module previously named Frida_Private has been renamed to FridaCore
v2.0.0-A-brave-new-world adds Dependency Track API integration, a new emulation kernel, Java analysis capabilities, and the EMBA launcher.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.0-A-brave-new-world https://github.com/e-m-b-a/emba.git
# already have the repo? check out this version:$ git checkout v2.0.0-A-brave-new-world
Add integration of the Dependency Track API to automatically upload and process generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
Add the EMBA launcher for simplified execution workflows
Add Java decompilation and security analysis capabilities to improve SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation
Switch to NVDv2 for CVE database queries
Update system emulation engine kernel from 4.1 to 4.14.336 LTS
checksec.sh 3.1.0 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration./BTI and x86 SHSTK/IBT checks, BIND_NOW detection via DT_FLAGS_1, kernel module support, and header suppression.
└──▷ GET THIS VERSION
$ git clone --branch 3.1.0 https://github.com/slimm609/checksec.sh.git
# already have the repo? check out this version:$ git checkout 3.1.0
└──▷ TRY IT
Suppress headers and banners when piping checksec output into a parser or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion script.
ILSpy v10.0-preview2 adds C# 14 extension members, batch PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis. generation, and navigate-visible-history UI.
└──▷ GET THIS VERSION
$ git clone --branch v10.0-preview2 https://github.com/icsharpcode/ILSpy.git
# already have the repo? check out this version:$ git checkout v10.0-preview2
Adds C# 14 extension members decompilation support.
Radare2 6.0.8 adds .NET/CIL support, Apple Filesystem, new partition formats, register rainbow coloring, and coredump improvements.
└──▷ GET THIS VERSION
$ git clone --branch 6.0.8 https://github.com/radareorg/radare2.git
# already have the repo? check out this version:$ git checkout 6.0.8
└──▷ TRY IT
List all available parse plugins in rasm2 to identify supported syntax front-ends.
$ rasm2 -LL
Adds initial CIL (Common Intermediate Language) disassembler and assembler for .NET PE assembly analysis.
Implements working support for .NET PE assemblies including .types for the PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis. plugin and a new RBin.pdb plugin.
Adds Apple FileSystem (APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices.) support including reading files in APFS mountpoints and retrieving file sizes.
Adds GPT partition table support.
Adds BSD DiskLabel partition support.
+23 moreshow less
Adds APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. (PMAP) Apple Classic partition support.
Adds EBR partition support alongside existing MBR support.
Implements dga command to coredump all memory maps.
Adds register rainbow coloring via the scr.rainwbow.regs option.
Adds asm.cmt.strings option to disable pointer strings in operation comments.
Implements tap:// IO plugin for reading SimH tape images.
Adds support for reading pipe/FIFO files with r2 <(command) process substitution syntax.
Supports AT&T syntax in x86 disassembly and ESIL generation.
Implements @@@m:perm foreach operator in the shell for iterating over maps by permission.
Implements typedef union and enum parsing in the KVC types parser.
Adds ${pal:} themed color support in scr.prompt.format.
Adds scr.vprompt.format option for visual mode prompt formatting.
Implements rasm2 -LL to list parse plugins.
Adds -hh extended help flag for rabin2 and rasm2.
Adds JSON output support to rafs2.
Adds R2_DOCDIR and R2PM_DOCDIR environment variables.
Colorizes permission fields in iS, dm, dmm, and om commands.
Implements bin.str.align option to discard unaligned strings.
Adds HTTP session registration APIs.
Supports binary data downloads via RSocket.get.
Enables raw IO by default.
Heavily refactors and improves the Z80 plugin including assembler and disassembler.
Exposes rbin metadata for .NET in disassembly output.
28 details in Everything
└──▷ BREAKING ON UPGRADE
!The a2f core plugin is removed; its functionality is now part of the anal component directly.
!The blaze analysis has been converted from a core plugin into an analysis plugin.
!pf2 is removed; pf is now the unified print format command.
!ESIL chevron shift operators are replaced with LSL, LSR, ASR, ROL.
Cortex Analyzers 3.6.8 adds three new analyzers: Safelink, Zscaler Internet Access URL Lookup, and isMalicious threat intelligence.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.8 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.6.8
Adds the Safelink analyzer for URL analysis via Microsoft Safelinks.
Adds the Zscaler Internet Access URL Lookup analyzer to query Zscaler ZIA for URL categorization and threat intelligence.
Adds the isMalicious analyzer for threat intelligence enrichment.
3 details in Everything
1 more release in this issue
· 2025-12-09 → 2025-12-31
Cortex Analyzers 3.6.4 adds Google Threat Intelligence and Orion Malware Analyzer integrations.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.4 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.6.4
Adds Google Threat Intelligence (GTI) analyzers as a new integration for threat enrichment.
Adds Orion Malware Analyzer as a new integration for malware analysis.
Supports arrays as hit results in analyzer output handling.
GRR v4 adds RRG (Rust) agent support, APIv2 migration, new ListFlowOutputPluginLogs endpoint and flow debugging UI
└──▷ GET THIS VERSION
$ git clone --branch v.4.0.0.0-release https://github.com/google/grr.git
# already have the repo? check out this version:$ git checkout v.4.0.0.0-release
└──▷ TRY IT
Fetch client flows including progress data in APIv2.
$ curl -X GET https://<grr-server>/api/v2/clients/<client_id>/flows?top_flows_only=false \ -H 'Authorization: Bearer <token>'
Adds a new ApiListAllFlowOutputPluginLogs endpoint for retrieving output plugin logs across all flows.
Enables server-side support for the Rust-based RRG agent alongside the legacy Python agent for action scheduling.
Introduces include_metadata argument to the ListGRRBinaries API method, returning binary size, signature validity and timestamp when true.
Extends /api/clients/<client_id>/flows with progress data via the top_flows_only=false parameter on the ListFlows method.
Changes the Interrogate flow return type from ClientSummary to ClientSnapshot, providing a superset of client information.
+1 moreshow less
Adds dark mode, nested flow display, and debugging logs for flows and fleet collections in the new UI layout.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Legacy HTTP API v1 (/api/...) is removed; all calls must now use the protocol-buffer-based APIv2 (/api/v2/...).
!The GetFile flow is no longer available.
!Variable hunts are no longer supported in Fleet collections.
!Custom OutputPlugin implementations must be replaced with OutputPluginProto implementations due to stateless protocol-buffer migration.
Timesketch 20251219 adds a streaming export API, bulk group sync, AI custom prompts, and new tsctl analyzer/story management commands.
└──▷ GET THIS VERSION
$ git clone --branch 20251219 https://github.com/google/timesketch.git
# already have the repo? check out this version:$ git checkout 20251219
└──▷ HOW TO FIND IT
Guide an AI investigation toward a specific hypothesis by entering a custom prompt in the AI investigation panel.
📍In the Timesketch UI, open a sketch and navigate to the AI Investigation view, then enter your custom prompt in the new prompt field before running the analysis.
Adds a custom prompt field to the AI investigation view, letting analysts guide LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered investigations with free-form input.
New high-performance streaming event export API and client support enables fast bulk event retrieval at scale.
New sync-groups-from-json tsctl command supports bulk user/group management from a JSON file.
New delete-group and help commands added to tsctl for group lifecycle management.
New tsctl analyzer-management command surface for managing analyzers from the CLI.
+5 moreshow less
Adds story section support to the tsctl CLI client, enabling story operations from the command line.
Adds timeline tooltip and local defaults to the timeline UI for improved timeline navigation.
Profiling configuration is now decoupled from the debug setting, allowing independent control of performance profiling.
Chunked processing support added to tsctl check-opensearch-links for handling large datasets.
Icons added to user/group autocomplete in the Share dialog for improved usability.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The timesketch.conf configuration file must be updated with a new config value introduced alongside the werkzeug dependency bump (see issue #3644).
MVT v2.7.0 adds VirusTotal checks for androidqf, new mounts and root_binaries modules, and an option to disable update checks.
└──▷ GET THIS VERSION
$ git clone --branch v2.7.0 https://github.com/mvt-project/mvt.git
# already have the repo? check out this version:$ git checkout v2.7.0
Extends VirusTotal checks to work with androidqf extractions in addition to ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control..
Adds mounts module for androidqf to inspect mounted filesystems on Android devices.
Adds root_binaries module for androidqf to detect root-related binaries on Android devices.
Adds options to disable automatic update checks.
Adds recognition of iPhone 16 and 17 models.
+1 moreshow less
Updates known iOS versions to include iOS 18.6.1 and 18.6.2.
MVT v2.6.1 adds Android tombstone file parsing, ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. keystore XML support, and new security warnings.
└──▷ GET THIS VERSION
$ git clone --branch v2.6.1 https://github.com/mvt-project/mvt.git
# already have the repo? check out this version:$ git checkout v2.6.1
Adds parser for Android tombstone files, enabling analysis of crash/kill records during forensic investigations.
Adds support for parsing ADB keystore in XML format, expanding credential and key artifact coverage.
Loads Android device timezone info and logs additional file modification events for richer timeline analysis.
Adds additional Android security warnings to surface more suspicious indicators during device checks.
osdfir-infrastructure 2.6.3 deploys Timesketch V3 by default via the charts/timesketch Helm chart.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.6.3 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.6.3
New Elcomsoft Quick Triage (EQT) tool adds rapid in-field forensic triage and VHDX container support for Windows systems.
Introduces Elcomsoft Quick Triage (EQT), a new GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.-based forensic triage solution for rapid data acquisition on Windows systems.
Adds support for collecting communications databases, email archives, user documents, and registry data from live systems or mounted disk images.
Enables on-the-fly indexing of acquired data into an instantly searchable database within the EQT interface during acquisition.
Supports storing all evidence in a single VHDX-based container file with metadata for later examination.
IPED 4.3.0 adds local/remote CSAM detection, age estimation, PhotoDNA for video, new AI tab, and dozens of new parsers and carvers.
└──▷ GET THIS VERSION
$ git clone --branch 4.3.0 https://github.com/sepinf-inc/IPED.git
# already have the repo? check out this version:$ git checkout 4.3.0
Adds a remote task to classify CSAM images, integrating with a proprietary service/model.
Adds a local CSAM Detector powered by proprietary models for on-device classification.
Introduces age estimation for detected faces.
Supports input images containing multiple faces and enhances Face Recognition.
Extends PhotoDNA hash matching to video files.
+16 moreshow less
Adds a dedicated AI tab to the analysis GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. surfacing AI-powered results.
Renders and navigates to quoted/reply messages in chats decoded from UFDRs.
Delivers major improvements to UFED Chat decoding.
Supports decoding WhatsApp Status changes.
Adds an NSKeyedArchiver parser for Apple serialized data.
Adds a Plist and binary plist viewer.
Adds a carver for 7-Zip archives.
Adds additional carving signatures for MPG and MP4, plus new carvers for HEIC, WEBM, and MKV.
Validates checksums of possible cryptocurrency seed phrases found during analysis.
Adds a regex detector for TRON blockchain addresses.
Adds a regular expression for the Brazilian DANFE fiscal key.
Supports parsing Transmission BitTorrent client control files.
Stores small view files directly in the database for faster access.
Optimizes processing queue ordering for improved throughput.
Upgrades the Telegram decoder plugin.
Updates German, Spanish, Italian, and French translations.
XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Collectors 1.5.1 update with adjusted health reporting and removed real-time status column.
Updated XDR Collectors to version 1.5.1 (Windows 1.5.1.2048, Linux 1.5.1.1950) for reduced noise in health reporting
Removed real-time status updates from the Status column on the XDR Collectors Administration page
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Status column on the XDR Collectors Administration page no longer displays real-time status updates for individual collectors.
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. collectors update health reporting logic.
Adds Possible multistage attack in Microsoft Teams alert and seven new Informational Analytics BIOCs to Cortex Analytics.
Added a new Low severity Analytics Alert for detecting possible multistage attacks involving Microsoft Teams.
Added seven new Informational Analytics BIOCs covering backup storage access, cloud object read activity, S3 block public access changes, AMI creation, Linux user creation, RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. group enumeration, and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. user data retrieval.
Added a new Informational Analytics Alert for detecting when an identity downloads multiple cloud objects.
Cortex Analytics adds new Low and Informational alerts/BIOCs for cloud-native email abuse, S3 bucket misconfigs, Kubernetes activity, and persistent storage.
Added a new Low Analytics Alert: 'Suspicious activity indicating a potential abuse of a cloud-native email service' to detect cloud email exploitation.
Prisma Cloud adds native API ingestion for dozens of AWS SageMaker, Backup, and Google Dialogflow resources in December 2025.
Adds support for ingesting aws-sagemaker-model-package-group resource type via sagemaker:ListModelPackageGroups API
Adds support for ingesting aws-sagemaker-image resource type via sagemaker:ListImages API
Adds support for ingesting aws-sagemaker-feature-group resource type via sagemaker:ListFeatureGroups API
Adds support for ingesting aws-sagemaker-app resource type via sagemaker:ListApps API
Adds support for ingesting aws-batch-scheduling-policy resource type via batch:ListSchedulingPolicies API
+47 moreshow less
Adds support for ingesting aws-sagemaker-project resource type via sagemaker:ListProjects API
Adds support for ingesting aws-sagemaker-pipeline resource type via sagemaker:ListPipelines API
Adds support for ingesting aws-sagemaker-data-quality-job-definition resource type via sagemaker:ListDataQualityJobDefinitions API
Adds support for ingesting aws-redshift-cluster-subnet-group resource type via redshift:DescribeClusterSubnetGroups API
Adds support for ingesting aws-rds-db-subnet-group resource type via rds:DescribeDBSubnetGroups API
Adds support for ingesting aws-configservice-aggregator-authorization resource type via config:DescribeAggregationAuthorizations API
Adds support for ingesting aws-mq-configuration resource type via mq:ListConfigurations API
Adds support for ingesting aws-backup-backup-selection resource type via backup:GetBackupSelection API
Adds support for ingesting aws-backup-report-plan resource type via backup:DescribeReportPlan API
Adds support for ingesting aws-backup-framework resource type via backup:DescribeFramework API
Adds support for ingesting aws-quicksight-vpc-connection resource type via quicksight:ListVPCConnections API
Adds support for ingesting aws-redshift-serverless-snapshot resource type via redshift-serverless:ListSnapshots API
Adds support for ingesting aws-redshift-serverless-namespace resource type via redshift-serverless:ListNamespaces API
Adds support for ingesting aws-redshift-serverless-endpoint-access resource type via redshift-serverless:ListEndpointAccess API
Adds support for ingesting aws-ssm-resource-data-sync resource type via ssm:ListResourceDataSync API
Adds support for ingesting aws-imagebuilder-image resource type via imagebuilder:GetImage API
Adds support for ingesting aws-imagebuilder-distribution-configuration resource type via imagebuilder:GetDistributionConfiguration API
Adds support for ingesting aws-ecs-capacity-provider resource type via ecs:DescribeCapacityProviders API
Adds support for ingesting aws-comprehend-entity-recognizer resource type via comprehend:ListEntityRecognizers API
Adds support for ingesting aws-msk-clusterV2 resource type via kafka:ListClustersV2 API
Adds support for ingesting aws-glue-ml-transform resource type via glue:GetMLTransforms API
Adds support for ingesting aws-ds-log-subscription resource type via ds:ListLogSubscriptions API
Adds support for ingesting aws-apigateway-usage-plan resource type via apigateway:GET API
Adds support for ingesting aws-athena-capacity-reservation resource type via athena:GetCapacityReservation API
Adds support for ingesting aws-athena-namedquery resource type via athena:GetNamedQuery API
Adds support for ingesting aws-athena-workgroup resource type via athena:GetWorkGroup API
Adds support for ingesting aws-athena-database resource type via athena:GetDatabase API
Adds support for ingesting aws-quicksight-user resource type via quicksight:DescribeUser API
Adds support for ingesting aws-code-build-report-group resource type via codebuild:BatchGetReportGroups API
Adds support for ingesting aws-code-deploy-deployment-config resource type via codedeploy:GetDeploymentConfig API
Adds support for ingesting aws-code-deploy-application resource type via codedeploy:GetApplications API
Adds support for ingesting aws-securityhub-finding-aggregator resource type via securityhub:GetFindingAggregator API
Adds support for ingesting gcloud-ai-applications-datastore resource type via discoveryengine.dataStores.list API
Adds support for ingesting gcloud-cloud-task-queue resource type via cloudtasks.queues.list API
Adds support for ingesting gcloud-cloud-task-cmek-config resource type via cloudtasks.cmekConfig.get API
Adds support for ingesting gcloud-compute-healthcheck resource type via compute.healthChecks.list API
Adds support for ingesting gcloud-dialogflow-es-agent resource type via dialogflow.agents.search API
Adds support for ingesting gcloud-dialogflow-es-encryption-spec resource type via dialogflow.encryptionspec.get API
Adds support for ingesting gcloud-dialogflow-cx-agent resource type via dialogflow.agents.list API
Adds support for ingesting gcloud-dialogflow-cx-securitysettings resource type via dialogflow.securitySettings.list API
Adds support for ingesting gcloud-cloud-firestore-backup resource type via datastore.backups.list API
Adds support for ingesting gcloud-conversational-insights-settings resource type via contactcenterinsights.settings.get API
Adds support for ingesting gcloud-logging-bucket-log-views resource type via logging.views.list API
Adds support for ingesting gcloud-dlp-discovery-scan-configuration resource type via dlp.jobTriggers.list API
Adds support for ingesting gcloud-dataplex-entry-type resource type via dataplex.entryTypes.list API
Adds support for ingesting gcloud-dataplex-entry-group resource type via dataplex.entryGroups.list API
Adds support for ingesting gcloud-dataplex-aspect-type resource type via dataplex.aspectTypes.list API
52 details in Everything
└──▷ BREAKING ON UPGRADE
!Azure onboarding Terraform script no longer requires Microsoft.MixedReality/ObjectAnchorsAccounts/read permission; existing scripts retaining this permission may fail on new deployments.
Sophos Central 2025.51 adds Switch security settings configuration for 802.1x, port security, and RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure./TACACS+ servers
└──▷ HOW TO FIND IT
Configure 802.1x authentication on a switch port via the UI to enforce device identity checks.
📍In Sophos Central, go to Switch › Security Settings › 802.1x Port settings and toggle authentication On, then select the desired authentication server.
Limit the number of MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. learned on a switch port to prevent unauthorized device connections.
📍In Sophos Central, navigate to Switch › Security Settings › Port security and enter the maximum allowed MAC address count for the target port.
Adds configuration of 802.1x Port settings (turn on/off, set authentication server) for Switches in Sophos Central
Adds port security setting to limit the number of MAC addresses a port can learn
Adds RADIUS server configuration for external authentication
Adds TACACS+ server configuration for external authentication
Central 2025.50 adds 802.11k/w SSID settings, DFS channel range selection, throughput metrics, and mesh node details.
└──▷ HOW TO FIND IT
Enable WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2.-Enterprise style management frame protection for sensitive networks.
OpenSnitch v1.8.0 adds a configurable audispd socket path and supports the opensnitch netfilter table for firewall rules.
└──▷ GET THIS VERSION
$ git clone --branch v1.8.0 https://github.com/evilsocket/opensnitch.git
# already have the repo? check out this version:$ git checkout v1.8.0
└──▷ HOW TO FIND IT
Verify that new pop-ups correctly identify snapd applications.
📍In the UI pop-up window, select snapd from the application path dropdown to allow or block a snap-based process.
Allows configuring the audispd_events socket path in the daemon to customize audit event ingestion
Uses a single netfilter table named opensnitch instead of multiple legacy tables (mangle, output, input, etc.)
Enables automatic selection of snapd paths in pop-up prompts via the UI
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. no longer supports PyQt5 by default, breaking compatibility with Linux Mint 21.2 or earlier, Ubuntu 22.04 or earlier, and OpenSuse 15.5 or earlier without manual package installation
Aviatrix CoPilot 4.28 adds Intrusion Log subtab in DCF Monitor and TLS controls for remote logging.
Adds an Intrusion Log subtab under Security > Distributed Cloud Firewall > Monitor for IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. Phase 2 (Preview) visibility
Adds dedicated TLS toggle and certificate upload/validation controls for remote rsyslog profiles in the UI
Reorganizes Cloud Assets menu into Cloud Workloads and Cloud Networks categories with Kubernetes Clusters and Serverless support
Aviatrix Controller 8.2.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. DCF support, FlightPath 2.0, TLS profiles, hierarchical policies, and more.
Adds FlightPath 2.0 for deep, topology-aware troubleshooting with CAI metrics and hop-by-hop path visualization
Extends Distributed Cloud Firewall (DCF) to Oracle Cloud Infrastructure (OCI), allowing rule enforcement on OCI gateways
Adds TLS Profile Extensions for DCF, enabling per-rule TLS profiles and multiple custom CA bundles for origin certificate validation
Introduces Hierarchical (MultiWriter) Policy via Terraform for distributed policy management and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
Enhances logging with configurable session-level logging options in Session Profiles, including duration, bytes transferred, and stage attributes
+12 moreshow less
Adds Controller CA Rotation capability for zero-downtime rotation of the Controller's internal CA certificate
Updates Terraform provider to support IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. constructs, Smart Gateway settings, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. profiles, advanced SNAT/DNAT options, hierarchical policy attachments, and logging/TLS profile objects
Enables DCF policy enforcement and SmartGroup discovery for Kubernetes private clusters
Changes default IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. ciphers to NIST-recommended AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. and deprioritizes weak ciphers
Adds BGPoLAN Gateway Resizing, allowing dynamic downsizing of AWS BGPoLAN gateways without service disruption
Enables Preview: IPv6 Capability Phase 1 for dual-stack networking across Controller, CoPilot, AWS, and Azure
Enables Preview: Active Mesh 4.0 Phase 1 with primary gateway lifecycle control, dynamic HPE toggle, and Make-Before-Break upgrade pipeline
Enables Preview: Smart Gateways Phase 1 with BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.-LU underlay and Controller offload capabilities
Enables Preview: Suricata-based IPS with customizable rulesets, external threat feeds, and Terraform/API automation
Enables Preview: Policy Audit Enhancement with structured diffs, change attribution, and API export
Enables Preview: DCF Serverless Rule Support for AWS Lambda discovery and Smart Group-based policy application
Enables Preview: Bump-in-the-Wire mode for AWS TGW + Cloud WAN for inter-VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. traffic inspection without TLS decryption
17 details in Everything
└──▷ BREAKING ON UPGRADE
!Gateway audit status indicators have been fully removed from the UI and API
!The historical default deny bootstrap rule has been relocated into the user-manageable ruleset; legacy allow/deny bootstrap rules may be safely removed after confirming equivalent policy coverage
!Legacy FQDN Filtering is deprecated; users must migrate to Distributed Cloud Firewall (DCF) FQDN/URL Filtering via WebGroups
!The legacy Stateful Firewall is deprecated; users must migrate to Distributed Cloud Firewall (DCF) Stateful Rules via SmartGroups
!ThreatIQ is deprecated; users must migrate to Distributed Cloud Firewall (DCF) ThreatGroups with integrated threat intelligence
!Geo Blocking is deprecated; users must migrate to Distributed Cloud Firewall (DCF) GeoGroups with country-level filtering
New Admin controls for JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. training timing and simulation types
Adds UI controls to enable or disable 24-hour and 7-day JIT training follow-ups.
Adds ability to select which phishing simulation types (Click, Credential) Autopilot includes.
2 details in Everything
9 more releases in this issue
· 2025-12-02 → 2025-12-11
Abnormal AI adds saved custom RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles via Settings > User Management for scalable team access control
└──▷ HOW TO FIND IT
Create a new custom role and assign permissions via the User Management interface.
📍Go to Settings › User Management, click Add User and + Create New Role.
Adds the ability to create and save custom user roles within the RBAC framework for reuse across teams
New GenAI Posture Explanations in Drift Log explain posture changes, config shifts, and security implications.
Adds GenAI Posture Explanations to the Drift Log, providing clear summaries explaining why a posture changed, what shifted in configuration, and the security impact
Enables viewing raw JSON before and after each change directly in the Drift Log for deeper visibility into exact environment updates
Malcolm v25.12.1 adds a Hedgehog run-profile label to the installer splash screen alongside component version bumps.
└──▷ GET THIS VERSION
$ git clone --branch v25.12.1 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.12.1
Installer splash screen now displays HEDGEHOG when Malcolm is launched using the Hedgehog run profile, making the active profile visually identifiable at startup.
1 detail in Everything
1 more release in this issue
· 2025-12-03 → 2025-12-17
Malcolm v25.12.0 unifies Hedgehog Linux and Malcolm ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. platforms, adds SMILE analytics visualizations, and expands NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. lateral-movement enrichment.
└──▷ GET THIS VERSION
$ git clone --branch v25.12.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.12.0
└──▷ USE IT
Set the Malcolm base URL so a remote Kibana instance can resolve extracted file download links and other absolute-path assets.
ini
MALCOLM_URL=https://malcolm.home.arpa
Adds MALCOLM_URL to dashboards-helper.env to set the base URL of the Malcolm instance, enabling remote Kibana instances to resolve absolute paths for extracted file downloads and other Malcolm-hosted assets.
Moves ARKIME_EXPOSE_WISE_GUI and ARKIME_ALLOW_WISE_GUI_CONFIG from arkime.env to arkime-offline.env, and changes the default value of ARKIME_EXPOSE_WISE_GUI from false to true.
Expands the default LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env to include additional protocol types (RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., VNC, SSH, and others) to improve lateral-movement tracking enrichments.
Unifies Hedgehog Linux and Malcolm ISO into a single containerized build workflow using the existing Hedgehog run-profile, eliminating duplicated system-process architecture for Arkime, Zeek, and Suricata.
Switches Hedgehog Linux network interface configuration from the legacy configure-interfaces script to NetworkManager; new installations will not automatically request IP addresses via DHCP.
+2 moreshow less
Adds four new SMILE analytics visualizations: BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks. Trends, DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches. Trends, Modbus Trends, RDP Connections Tree, and SSH Connections Tree.
Updates the existing Connections Tree SMILE visualization.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!ARKIME_EXPOSE_WISE_GUI and ARKIME_ALLOW_WISE_GUI_CONFIG are moved from arkime.env to arkime-offline.env; any manual configuration of these variables in arkime.env will no longer take effect.
!The default value of ARKIME_EXPOSE_WISE_GUI changes from false to true; deployments that relied on the WISE GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. being hidden by default must now explicitly set it to false in arkime-offline.env.
!There is no upgrade path from previous Hedgehog Linux installations to the new containerized platform; existing sensors must be reimaged, with /opt/sensor/sensor_ctl/control_vars.conf and other relevant data backed up beforehand.
!New Malcolm and Hedgehog Linux installations configured via NetworkManager will not automatically request IP addresses using DHCP.
!The deprecated ./scripts/legacy_install.py installer script has been removed; users must use install.py instead.
!The osd_transform_vis plugin is removed from Dashboards; visualizations built with it will no longer render on Elastic/Kibana-based Malcolm installations.
CrowdSec v1.7.4 adds a WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. DropRequest hook helper, syslog log media support, and a new option to disable usage metrics export.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.4 https://github.com/crowdsecurity/crowdsec.git
# already have the repo? check out this version:$ git checkout v1.7.4
└──▷ USE IT
Block a request directly inside a WAF hook without relying on a detection rule match — useful for custom pre/post-processing logic.
Disable usage metrics export on a self-hosted LAPI server to prevent telemetry data from leaving the environment.
yaml
api:
server:
disable_usage_metrics_export: true
Route all CrowdSec log output to syslog instead of a file, useful in containerised or systemd-managed deployments.
yaml
common:
log_media: syslog
Adds DropRequest helper to WAF hooks, enabling rules to programmatically block requests directly within AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. hook logic.
Adds log_media="syslog" logging configuration option, allowing CrowdSec to route log output to syslog.
Adds api.server.disable_usage_metrics_export option to suppress usage metrics export from the LAPI server.
bettercap v2.41.5 adds pcapng capture format, new BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems./LAN/WiFi count APIs, and JS filesystem helpers.
└──▷ GET THIS VERSION
$ git clone --branch v2.41.5 https://github.com/bettercap/bettercap.git
# already have the repo? check out this version:$ git checkout v2.41.5
Supports pcapng format for modern, richer packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. output.
New ble.NumDevices() session variable returns count of discovered BLE devices.
New lan.NumHosts() session variable returns count of discovered LAN hosts.
New wifi.NumAPs() session variable returns count of discovered WiFi access points.
Exposes BLEDeviceJSON for external programmatic use.
+2 moreshow less
Adds JS mkdirAll function for directory creation in caplets.
Adds JS appendFile function for file append operations in caplets.
Zeek v8.1.0 adds log length truncation vars, SHA-224/384/512 hashes, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. discarded packet events, and systemd generator.
└──▷ GET THIS VERSION
$ git clone --branch v8.1.0 https://github.com/zeek/zeek.git
# already have the repo? check out this version:$ git checkout v8.1.0
└──▷ HOW TO FIND IT
Monitor QUIC connections that are being dropped due to protocol violations.
📍cat <<'EOF' | zeek -C
event QUIC::discarded_packet(c: connection) {
print fmt("Discarded packet in %s", c$id$orig_h);
}
@load base
EOF
Adds Log::default_max_field_string_bytes and three other log truncation variables to control maximum string and container lengths in output
Adds SHA-224, SHA384, and SHA512 hash BiFs (sha224_hash, sha384_hash, sha512_hash and their init/update/finish counterparts)
Adds QUIC::discarded_packet event for packets with fixed_bit 0, controllable via QUIC::max_discarded_packet_events
Adds zeek-systemd-generator executable and /etc/zeek/zeek.conf for opinionated single-node cluster deployment on Linux
4 details in Everything
└──▷ BREAKING ON UPGRADE
!ClusterBackend in zeekctl.cfg now defaults to ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker.; existing Broker users must set ClusterBackend = Broker and run zeekctl deploy.
Security Onion 2.4.200 adds advanced ILM controls in SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. UI, PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. annotations, JA4D fingerprinting, AI assistant model management, and Suricata 8.0.2.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.200-20251216 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.200-20251216
└──▷ HOW TO FIND IT
Enable JA4D TLS fingerprinting in Zeek to get richer client classification beyond standard JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies..
📍In the SOC console, go to Administration › Configuration › zeek › config.zeek.ja4 and enable the JA4D option.
Adds Advanced ILM (Index Lifecycle Management) actions accessible directly from the SOC UI.
Adds PCAP annotations, enabling analysts to annotate packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. data within the interface.
Adds JA4D fingerprinting option via config.zeek.ja4 for enhanced TLS client fingerprinting.
Upgrades Suricata to version 8.0.2.
Adds AI Assistant model availability listing and per-model enabled/disabled flag in the assistant configuration.
+5 moreshow less
Adds context prompt compression for the AI Assistant.
tcpdump 4.99.6 adds -g option for single-line IPv4 output and supports unit suffixes on -C file size
└──▷ GET THIS VERSION
$ git clone --branch 4.99.6 https://github.com/the-tcpdump-group/tcpdump.git
# already have the repo? check out this version:$ git checkout 4.99.6
Adds the -g option to print IPv4 verbose output on a single line
Adds optional unit suffix support on the -C file size parameter
Updates VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. decoding to include UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port 8472 (used by Linux) as a default known port
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Removes protocol decoding support for the obsolete OTV draft-hasmit-otv-04
Updated CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark policies for AWS and Azure in December 2025 release
Updated CIS AWS Foundations 5.0 policies are now active in Cloud Optix, including new checks like AR-1087 (EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. IMDSv2) and AR-1088 (CIFS access restrictions).
eksctl v0.221.0 adds support for the us-isob-west-1 isolated region.
└──▷ GET THIS VERSION
$ git clone --branch v0.221.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.221.0
Supports the us-isob-west-1 (US ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-B West) region for cluster management.
1 detail in Everything
1 more release in this issue
· 2025-12-01 → 2025-12-18
Cloud Custodian 0.9.48 adds new AWS/Azure/GCP resources, KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. rotation filters, WAFv2 logging actions, and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Lattice support.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.48.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.48.0
└──▷ TRY IT
Detect KMS keys that have not been rotated within the last 365 days to enforce rotation compliance.
New aws.iam-access-key resource enables policies targeting IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. access keys directly.
New aws.lambda-event-source-mapping resource supports managing Lambda event source mappings.
Adds three new AWS VPC Lattice resources: aws.vpc-lattice-service, aws.vpc-lattice-service-network, and aws.vpc-lattice-target-group.
New ami-block-public-access filter on aws.account to detect accounts without AMI public-access blocking.
New last-rotation filter on aws.kms-key to identify keys by their last rotation date.
+15 moreshow less
New upgrade-available filter on aws.cache-cluster (ElastiCache) to find clusters eligible for engine upgrades.
New upgrade-available and cross-account filters on aws.kafka for MSK cluster governance.
New set-logging action on aws.wafv2 to configure WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. logging destinations.
New delete action on aws.subnet for automated subnet removal.
New delete-listener action on aws.app-elb for Application Load Balancer listener management.
New current-version and replica-attribute filters on aws.secrets-manager for version- and replica-level secret inspection.
New resolver-query-logging filter on aws.vpc to check VPC DNS query logging configuration.
New analytics-association filter on aws.connect-instance for Amazon Connect analytics governance.
New azure.entraid-user resource adds base Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. support for user-level policies.
New azure.elasticache-reserved resource for managing Azure Cache reserved capacity.
New update action on azure.keyvault-key for modifying Key Vault key attributes.
New gcp.certmanager-certificate resource for managing GCP Certificate Manager certificates.
Adds EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. server-side query filtering to reduce data fetched during resource enumeration.
Extends aws.fsxdelete-file-system action to support additional FSx file system types.
Extends aws.firehose delete action to handle suspended delivery streams.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!The metrics filter is removed from aws.opswork-stack.
!The metrics filter is removed from gcp.spanner-backup and gcp.spanner-database-instance.
Policy Sentry 0.15.1 refreshes the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. actions database and drops Python 3.9 support.
└──▷ GET THIS VERSION
$ git clone --branch 0.15.1 https://github.com/salesforce/policy_sentry.git
# already have the repo? check out this version:$ git checkout 0.15.1
Updates the bundled IAM actions database with the latest AWS service catalog data.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Python 3.9 is no longer supported; upgrading requires Python 3.10 or later.
Prowler 5.16.0 adds MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface.-powered Lighthouse AI, Simple Mutelist, category filtering on findings endpoints, and two new AWS check categories.
└──▷ GET THIS VERSION
$ git clone --branch 5.16.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.16.0
└──▷ TRY IT
Filter findings by category via the API to feed a downstream dashboard focused on a specific security domain.
Integrates Prowler's official MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server with Lighthouse AI for standardized, faster AI-driven security interactions.
Adds new MCP tools for Compliance Framework Management, enabling AI assistants to query compliance status and drill down to requirement-level details.
Introduces Simple Mutelist: mute findings directly from the findings table and manage mute rules via a new /mutelist page with Simple and Advanced (YAML) tabs.
New category overview endpoint provides severity breakdowns by security domain across your environment.
Adds category filter support to GET /findings and GET /findings/latest endpoints for scoped security domain analysis.
+6 moreshow less
PDF reports now include Account ID, Alias, and Provider Name directly in the reporting table.
Adds two new AWS check categories: privilege-escalation and ec2-imdsv1, improving visibility into high-risk misconfigurations.
Adds Risk Radar component with category-based severity breakdown to the Overview page in the UI.
Adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and API Key link cards to the Integrations page for better discoverability.
Exposes richer resource details (partition, details, and metadata) in Findings detail and Resources detail views.
Adds IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. supported formats and scanner documentation for the IaC provider.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!The GET /overviews/attack-surfaces endpoint no longer returns related check IDs in its response; consumers that depend on that field will receive an incomplete payload.
1 more release in this issue
· 2025-12-11 → 2025-12-18
Prowler 5.15.0 adds Alibaba Cloud support, a redesigned MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., 5 new checks, and a richer Overview dashboard with Attack Surface, Threat Map, and Risk Pipeline panels.
└──▷ GET THIS VERSION
$ git clone --branch 5.15.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.15.0
└──▷ TRY IT
Query daily aggregated findings by severity over time via the new API endpoint to track posture trends in a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or dashboard.
Adds Alibaba Cloud as a new CLI provider with 63 available checks and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 2.0 benchmark support.
Adds MongoDB Atlas provider support in the Prowler App for assessing managed database cluster security posture.
Redesigns the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server with comprehensive tools for Findings, Provider Management, Resource Management, Muting Management, and Scan Management — enabling AI-driven security workflows.
New Overview dashboard panels: Attack Surface (internet-facing resources, leaked secrets, privilege-escalation paths), Service Watchlist, Findings Severity Over Time, Risk Pipeline (Sankey chart), Threat Map (region-based pass/fail ratios), and Risk Plot (severity-weighted Threat Score visualization).
New API endpoint GET /api/v1/overviews/findings_severity/timeseries for daily aggregated findings by severity level.
+11 moreshow less
New API endpoint to retrieve an overview of attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
Lighthouse AI now supports Amazon Bedrock API key authentication as an alternative to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. access keys.
New GCP check cloudstorage_uses_vpc_service_controls detects Cloud Storage buckets not protected by VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Service Controls.
New GCP check compute_instance_preemptible_vm_disabled detects compute instances configured as preemptible VMs.
New GCP check compute_instance_automatic_restart_enabled verifies automatic restart is enabled on compute instances.
New GCP check compute_instance_deletion_protection_enabled verifies deletion protection is enabled on compute instances.
New GitHub check repository_immutable_releases_enabled detects repositories without immutable releases enforced.
Adds Processing Integrity requirements to the SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. compliance framework for AWS, Azure, and GCP providers.
Adds RBI Cyber Security Framework compliance support for the Azure provider.
Adds CIS Alibaba Cloud Foundation Benchmark v2.0.0 compliance framework.
Introduces a navigation loading bar in the UI for visual feedback during page transitions.
CloudFox v1.17.0 adds Route53 Alias record support, KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. to resource-trusts, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. policies, Linux Arm64 builds, and unified logrus logging.
└──▷ GET THIS VERSION
$ git clone --branch v1.17.0 https://github.com/BishopFox/cloudfox.git
# already have the repo? check out this version:$ git checkout v1.17.0
└──▷ TRY IT
Enumerate cross-account KMS key trust policies alongside other resource trusts in a single pass.
$ cloudfox aws resource-trusts
List all Route53 records including Alias records (e.g., ELB/CloudFront targets) for subdomain takeover research.
$ cloudfox aws route53
Adds Route53 Alias record support to the route53 command.
Adds container name column to the ecs-tasks command output.
Adds KMS service support to the resource-trusts command.
Adds OpenSearch resource-trust policy enumeration to the resource-trusts command.
Adds Linux Arm64 build support.
+2 moreshow less
Adds checksums to release packages.
Adds split-level logging via logrus, with all successful API calls logged to cloudfox-info.log.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!Versions prior to v1.17.0 depend on a JSON file from AWS that changed its format and no longer work; upgrading to v1.17.0 is required for continued operation.
Inspektor Gadget v0.47.0 adds image verification, cosign bundle support, symlink-resolved file paths in trace_open, and stdin manifest apply.
└──▷ GET THIS VERSION
$ git clone --branch v0.47.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.47.0
└──▷ TRY IT
Apply a gadget manifest piped from another command without writing it to disk first.
$ cat my-gadget.yaml | ig run -f -
Adds ig image verify command to verify gadget image signatures from the CLI.
Supports cosign bundle format for gadget image signature verification.
Adds resolved file path (after symlink resolution) to trace_open events.
Allows -f - to apply a gadget manifest from stdin.
Adds metricname annotation support to the otel-metrics operator for custom metric naming.
+1 moreshow less
Appends sort fields when the same datasource is specified multiple times in the sort operator.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The otel-metrics operator now defaults metricname to FullName instead of the previous default, which may change metric names in existing dashboards or alerting rules on upgrade.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.68.0 adds trivy cloud subcommand, --cacert flag, and unique ID fields to scan targets and reports.
└──▷ GET THIS VERSION
$ git clone --branch 0.68.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.68.0
└──▷ TRY IT
Use a custom CA certificate to scan an environment requiring trusted private CAs
Officially supports use as a Go SDK for embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. Compose into third-party software without requiring Docker CLI.
Delegates all image building to Docker Bake (internal BuildKitBuildKitA build engine for Docker images, maintained by Moby, that replaces the legacy Docker builder with parallel layer execution, cache mounts, and secret handling — giving cyber tools faster, more reproducible container builds. builder removed), aligning with docker build behavior.
Adds --wait option to the compose start command to block until services are healthy.
Adds build.no_cache_filter support in Compose files to selectively skip cache for specific build stages.
Introduces --insecure-registry flag (reserved for testing scenarios).
+2 moreshow less
Runs lifecycle hooks on service restart.
Adds LoadProject to the Compose API definition, expanding SDK surface.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The internal BuildKit builder has been removed; builds are now fully delegated to Docker Bake. Any workflow relying on Compose's internal builder will break on upgrade.
cilium-cli v0.18.9 adds TLS/mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for Operator Prometheus and CILIUM_NAMESPACE env var support
└──▷ GET THIS VERSION
$ git clone --branch v0.18.9 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.18.9
└──▷ TRY IT
Avoid typing --namespace on every command when your Cilium install lives in a non-default namespace.
$ export CILIUM_NAMESPACE=kube-system
cilium status
cilium connectivity test
Adds TLS/mTLS support for the Operator Prometheus endpoint using an existing Kubernetes secret.
Allows setting the default Cilium namespace via the CILIUM_NAMESPACE environment variable, replacing the need to pass --namespace on every command.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The CiliumBGPPeeringPolicyCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and its agent implementation have been removed. Migrate to the cilium.io/v2CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.: CiliumBGPClusterConfig, CiliumBGPPeerConfig, CiliumBGPAdvertisement, and CiliumBGPNodeConfigOverride.
!Cilium v1.15 is now the minimum required version; clusters running older Cilium releases are no longer supported.
Anchore Enterprise v4.8.0 adds Kubernetes/ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. vulnerability reports, config-driven resource reduction, and UI repository toggle control
Adds Vulnerabilities by Kubernetes Container report template for filtering vulnerabilities within Kubernetes containers.
Adds Vulnerabilities by ECS Containers report template for filtering vulnerabilities within ECS containers.
Adds ANCHORE_POLICY_ENGINE_ENABLE_IMAGES_BY_VULN_QUERY environment variable to disable the /v1/query/images/by_vulnerability API and stop SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. vulnerability rescans for resource reduction.
Adds services.policy_engine.enable_images_by_vulnerability_api config key in config.yaml for Helm deployments to control image-by-vulnerability query functionality.
Adds enable_add_repositories property to config-ui.yaml allowing suppression of Watch Repository toggles in the UI registry and repository view tables.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Setting the new configuration options to false disables the /v1/query/images/by_vulnerability API (returning 501) and stops SBOM vulnerability rescans.
Clair v4.9.0 adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. encoder, configurable VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. timeout, SUSE dynamic distro support, and NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. 2.0 CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. data
└──▷ GET THIS VERSION
$ git clone --branch v4.9.0 https://github.com/quay/clair.git
# already have the repo? check out this version:$ git checkout v4.9.0
Adds updaters.config.rhel-vex.compressed_file_timeout config key to control the download timeout for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. VEX archives
Adds SPDX-2.3 document encoding capability for index reports via a new encoder
Switches CVSS enrichment from NVD 1.1 to NVD 2.0 JSON feeds
Adds dynamic discovery support for suse.linux.enterprise.server and opensuse.leap distributions
Kata Containers 3.24.0 adds device cold plug support, virtio-blk iothreads, IOMMUFD QMP commands, and dynamic queue config via Pod annotations
└──▷ GET THIS VERSION
$ git clone --branch 3.24.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.24.0
Adds IOMMUFD object creation capabilities for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. QMP commands within the runtime to improve GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. device passthrough management.
Introduces an iothreads framework for virtio-blk devices, allowing independent I/O processing threads for storage performance.
Updates the genpolicy tool to support both runtime-rs and runtime-go runtimes through a unified cpath compatibility layer.
Plerion introduces a new scheduling interface for workload scanning, letting users choose between daily, recommended, or custom intervals to better control coverage cadence.
Cloudmersive Cloud Document AI API v2-0-4 adds enhanced CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. support.
Cloudmersive Cloud Spam Detection API v2-3-3 adds input file formats and enhanced CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. support.
Adds more input file formats for spam detection analysis
Enhances CORS support for broader browser-based integration
OpenCTI 6.9.0 adds PIR playbooks, Security Coverage entity, Decay Exclusion Rules, Form Intake, SSH keys, and new connectors
└──▷ GET THIS VERSION
$ git clone --branch 6.9.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.9.0
Threat Map widget in Priority Intelligence Requirements (EE)
Priority Intelligence Requirements are now actionable within playbooks via threat filtering and scores (EE)
New Security coverage entity type for CTI-driven assessment with OpenAEV (CE)
Security coverage creation and generation can be automated through the playbook engine (CE)
Authorize Members on Drafts feature to restrict draft validation/modification (CE)
+19 moreshow less
Service Account bypass of Authorize Members permissions as default behavior (CE)
Form Intake framework for importing data via structured forms (CE)
Bulk search module improvement with differentiated management for known and unknown entities (CE)
Floating action button replacement for creating relationships on entity tabs (CE)
Custom themes support for corporate branding alignment (CE)
New SSH key observable type (CE)
Markdown to HTML conversion in email notifier for consistency (CE)
Pattern matching filter now available for indicators in playbooks, Live streams, CSV Feeds, and TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. Collection (CE/EE)
Global HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy configuration for Composer (EE)
Playbook capability split into Manage playbooks and Use playbooks capabilities (EE)
Merge and delete separated into distinct capabilities (CE)
Entity history logs now show initial value and new one for each change line (CE)
Send email from template box in playbooks with dynamic object variables (EE)
Prepopulated onboarding email template for new platforms (EE)
Support for CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 3.0 vector strings (CE)
New Import Connectors: DShield.org, Criminal IP C2 Daily Feed, TeamT5, FT3, SPARTA
New Enrichment Connectors: ESET, Kaspersky
New Stream Connector: MISP Intel
New Stream Connector: Splunk SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. Push
24 details in Everything
└──▷ BREAKING ON UPGRADE
!Playbook capability split into Manage playbooks and Use playbooks capabilities (EE)
OpenCTI 6.8.17 adds Security Coverage via Playbooks and API client provider identification.
└──▷ GET THIS VERSION
$ git clone --branch 6.8.17 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.8.17
└──▷ TRY IT
Identify which external threat intel provider generated data by setting the worker's API client identifier.
$ # Set environment variable for the worker to identify its source in logs/user-agent
export CONNECTOR_API_CLIENT_USER_AGENT_PROVIDER='my_threat_intel_provider'
Use the new playbook component to automatically generate and manage Security Coverage records based on your tooling.
📍# In OpenCTI Console:
# 1. Navigate to Playbooks
# 2. Create a new playbook
# 3. Add action: Create Security Coverage
# 4. Configure duration, type_affinity, and platforms_affinity fields
Adds ability to specify a provider in the API client user agent for workers
Creates Security Coverage entities through playbooks
Introduces duration, type_affinity, and platforms_affinity fields to Security Coverage for scenario generation
ThreatStream OnPrem 6.0 adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. profile JSON export, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. API creds, Google TI integration, and Anomali Copilot.
Adds created_ts and source_created fields for advanced search-based rule matching
Supports exporting MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. profile security coverage in JSON format
Enables User & Role Management for role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 support for API Credentials
Activates Google Threat Intelligence integration for Passive DNS enrichments
+3 moreshow less
Adds Anomali Copilot chat with agentic search capabilities in the UI
Introduces new indicator types: benign_domain, phish_file_name, fraud_file_name, mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url
Adds support for multiple platform submissions, QR code scanning, file password protection, and URL/file artifact submission for Polyswarm malware detonation
ThreatStream adds Lock SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Configuration feature and VMRAY Essential feed
Adds ability to lock or unlock SSO settings via the Lock SSO Configuration feature to prevent unauthorized changes
Makes VMRAY - UniqueSignal - Essential premium feed available for activation in the APP Store
Anomali Dashboards adds Role Based Access Control for user-created dashboards and refreshes the Dashboard Library UI
Adds role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to restrict who can view or modify user-created dashboards.
Refreshes Dashboard Library UI with improved filtering and permission-aware dashboard listing.
Improves Dashboard Library experience by respecting sharing and permissions for out-of-the-box, shared, and custom dashboards.
Anomali Search adds IsolationForest operator, Decision Tree visualization, and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for lookup tables/macros.
Adds IsolationForest operator to isolate anomalies in high-volume event data using an unsupervised algorithm
Adds Decision Tree visualization type to explore tree-based machine learning models and their results
Enables role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for user-created lookup tables
Enables role-based access control for user-created macros
Anomali Search now supports automatic JSON field extractions to allow flexible AQL queries on unmapped fields.
Adds automatic JSON field extractions to enable viewing and using extracted fields in AQL queries for downstream analysis without requiring mapping to the standard Anomali eventlog schema
Introducing Filter Sharing in Echosec to help teams synchronize and reduce noise in open-source intelligenceopen-source intelligenceOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. datasets.
Adds Filter Sharing capability in Echosec to enable team synchronization of filters.
Introduces the Optimize Locations button in Monitor and Locate views to generate AI-driven location keywords.
└──▷ HOW TO FIND IT
Use the new UI controls in the Monitor view to automate keyword research for location-based monitoring alerts.
📍In the Monitor view, create a new location-based search and click the Optimize Locations button next to the search bar. Use the pen icon to select location types such as tourist attractions, then refresh to generate suggestions.
Adds an Optimize Locations button next to the search bar in the Monitor view for AI-generated location-based keyword suggestions
Adds an Optimize Locations button next to the search bar in the Locate view for AI-generated location-based keyword suggestions
Enables selection of specific location types (e.g. tourist attractions, schools) via a pen icon within the Optimize configuration step
Introduces Echosec Optimize, an AI-powered feature for generating location-based keywords to improve search results.
Adds Echosec Optimize, an AI-driven capability that generates hyper-relevant, location-based keywords to address the scarcity of geotagged social media data.
Adds /json/v3/search-by-pc endpoint for threat hunting by machine name
New endpoint /json/v3/search-by-pc enables asset-based threat hunting and infrastructure security monitoring by searching for compromises via computer/machine names.
The endpoint supports up to 50 computer names per request, accepts case-insensitive matching, and allows filtering by credential types (employees, users, third_parties) and domains.
Adds search_data to the additional_fields array in the API for browsing history insights.
Added search_data field (string) to the additional_fields array in the /json/v3/search-by-domain API response, exposing search queries, engines, and timestamps from compromised devices.
New IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. table in Insights Cards for direct threat attribution
Adds an IoCs table within the Insights Card for threat actors, malware families, and cyber attacks
Eliminates the need to jump between tabs or hunt through reports to find related IoCs
2 details in Everything
1 more release in this issue
· 2025-12-10 → 2025-12-24
Enrich Vertex Synapse with Feedly Threat Graph intelligence and extract registry keys IoCs
Integrates Feedly integration with Vertex Synapse to automatically ingest indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (IoCs), CVEs, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., threat actors, and malware enriched with context from the Feedly Threat Graph.
Adds a new AI Model for registry keys IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. types that is STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form.-ready and includes enhanced metadata extracted from source article context.
Introduces a new Threat Actors from North Africa AI Model.
MISP v2.5.31 adds NOCACTI threat feeds, refreshed knowledge bases, and widens the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec for galaxy cluster exports.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.31 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.31
└──▷ HOW TO FIND IT
Pull in the new NOCACTI feeds via the MISP UI after upgrading to start ingesting adversary infrastructure and intrusion indicators.
📍In the console, go to Sync Actions › Feeds, find the NOCACTI Adversary Infrastructure and NOCACTI Intrusion feeds in the feed list, enable them, then click Fetch and store all feed data.
Fetch galaxy clusters via the API passing distribution as an array — now officially supported by the updated OpenAPI spec.
Adds NOCACTI Adversary Infrastructure / Intrusion feeds as new built-in threat intelligence sources.
Updates taxonomies, galaxies, object templates, warning lists, and GeoOpen to latest versions.
Expands OpenAPI spec for exportGalaxyClusters: documents additive default/custom inclusion behavior and allows distribution to be passed as an array.
Changes default sighting visibility to Everyone (previously Event Owner).
Sync users can now update sharing groups they can see and push updates via different sync connections than the original source.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Default sighting visibility is now set to Everyone instead of Event Owner — instances relying on the previous default to restrict sighting visibility to the event owner will expose sightings more broadly after upgrade.
3 more releases in this issue
· 2025-12-11 → 2025-12-23
MISP v2.5.30 ships an opt-in beta UI/UX mode, faster org-logo loading, and new MMDBMMDBA binary database file format designed for fast IP-address lookups, maintained by MaxMind, used by cyber tools to resolve IPs to geolocation or ASN data without external API calls./vulnerability-lookup workflow action modules.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.30 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.30
└──▷ HOW TO FIND IT
Enable the new beta UI/UX mode to get the redesigned Event Index and navigation — useful for evaluating the next-generation interface before it becomes the default.
📍In the MISP UI, go to your User Settings and enable the beta UI / UX mode option.
Adds opt-in beta UI/UX mode (via user settings) with a redesigned Event Index featuring responsive layout, distribution widgets, humanized timestamps, and consolidated action dropdowns.
Redesigns top navigation bar with reorganized clustering and fly-out menus in the new beta mode.
New dedicated endpoint for organization logo loading uses cached images instead of live base64 decoding, significantly speeding up Event Index rendering.
New workflow Action modules enable automatic tag enrichment from MMDB geolocation data and vulnerability information from vulnerability-lookup.org.
MISP v2.5.29 ships a beta UI/UX mode with redesigned Event Index and new MMDBMMDBA binary database file format designed for fast IP-address lookups, maintained by MaxMind, used by cyber tools to resolve IPs to geolocation or ASN data without external API calls./vulnerability-lookup workflow action modules.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.29 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.29
└──▷ HOW TO FIND IT
Enable the beta UI/UX mode for your account to get the redesigned Event Index and new navigation.
📍In the MISP console, go to your User Settings and enable the beta UI / UX mode option.
New opt-in beta UI/UX mode available via user settings, featuring a redesigned Event Index with responsive layout, distribution widgets, humanized timestamps, consolidated action dropdowns, and a reorganized fly-out navigation bar.
New dedicated endpoint for organization logo loading in the Event Index uses cached images instead of live base64 decoding, significantly faster rendering.
New Action modules for Workflows enable automatic tag enrichment based on MMDB geolocation data and vulnerability information from vulnerability-lookup.org.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The url field in Bookmarks has been renamed to text; any integration or script referencing the url field by name will break.
MISP v2.5.28 adds MISP version to OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec, Gridstack 12 dashboard, and an OpenBSD 7.8 installation guide.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.28 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.28
Adds MISP version field to the OpenAPI specification.
Migrates the dashboard to Gridstack 12.
Adds installation guide for OpenBSD 7.8.
Adds CSIRT.SK to the Slovak MISP Community defaults and meta community vetting process.
Redacts creator user information in Collections data for non-site administrators.
+1 moreshow less
Optimizes tag filtering logic by dynamically choosing between EXISTS and UNION query strategies based on attribute filter weight.
?page=<page>&page_size=<size> query parameters now supported on Data Leak, Site Monitoring, DNS Finder and Legitimate Domains API endpoints with configurable page_size (1–1000, default 100)
Threats Watcher article lists now support pagination via the same page/page_size parameters
Exabeam Dec 2025 adds Azure/Gemini collectors, User Entity Links table, detection grouping by ID, analytics rule insights and JSON export
Adds Azure Blob Storage Cloud Collector for ingesting threat detections, security alerts, and defender OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. logs from Azure
Adds Gemini Enterprise Cloud Collector for ingesting Model Armor prompts logs via GCP Pub/Sub
Adds Gmail BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. Cloud Collector in Early Access for ingesting Gmail logs
Adds User Entity Links pre-built context table to control identity-to-entity linking in Attack Surface Insights
+15 moreshow less
Extends entity deletion window in Attack Surface Insights to entities created in the past 1,000 days
Adds Event ID hover, Find in search link, and Copy to clipboard button for user entity details
Adds detection grouping by Detection ID in Correlation Rules, Threat Center, and Threat Detection Management
Expands Condition Operators for Filtered Context Tables to include Equals Ignoring Case, Starts With, Not Starts With, Not Equals
Makes Log Source Policy conditions editable and adds Date Filter and TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. setting for log source retention
Enhances Host to IP Enrichment in Log Stream with expanded default filters and early access for custom exclusion conditions
Adds Global Token Revocation (Universal Logout) option when configuring Auth0 with Okta Identity Provider
Limits Webhook View Details dialog to the 10 most recent responses over 48 hours to improve load performance
Toggles parsed fields display and reduces drill-down clicks in the Search Timeline View
Extends default search retention from 31 days to 45 days for New-Scale Analytics and Fusion licenses
Adds Threat Center global notifications including Case name, Exabeam Nova Investigation Summary, Risk score, Classification, and Threat vector
Adds Analytics Rules Insights column with suggested exclusion expressions for over-triggering rules
Adds JSON tab to view analytics rule configuration and Required Event Fields list in rule details
Enforces prerequisite to apply pending analytics rule changes before enabling or deleting exclusions
Adds 46 new pre-built analytics rules for defense evasion, persistence, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and reconnaissance
Hunters Pathfinder AI Open Beta, new IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, and multiple integrations
Pathfinder AI moves to Open Beta on Jan 7, 2026, enabling automatic AI-driven investigations on all relevant alerts within the Hunters platform.
IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search now supports IPv6 addresses for indicator lookups.
Adds CrowdStrike Falcon 3rd party XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. detections via a new Alerts API endpoint integration.
Enrichments now display service operations made on an agent ID in the 24 hours prior to lead start time.
New integrations: Checkpoint EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. (S3), KnowBe4 PhishER (Webhook/S3), Netskope Network Events (API), Cerberus (S3), Windows DNS channel/debug logs (S3), GCP-V2 SCC Assets/Findings (API), Pan firewall Users (API), BeyondTrust PW safe On-Prem (S3 migration).
5 details in Everything
└──▷ BREAKING ON UPGRADE
!CrowdStrike Incident logs are being retired; users must migrate to the CrowdStrike Alerts (crowdstrike_alerts) integration before March 9, 2026.
!Microsoft Message Trace legacy tools and APIs will be turned off on March 18, 2026; users must migrate to Microsoft's Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. endpoint for continued email log ingestion.
Sekoia.io adds Integration Rules filtering and Rule Lifecycle management to the Rules Catalog
Adds Integration Rules feature to identify and filter rules sourced from third-party integrations.
Adds Rule Lifecycle feature to offer TDR and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams new maintenance capabilities for detection strategy.
Databricks adds single-use refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. for OAuth apps
Databricks Mosaic AI Model Serving now supports Anthropic Claude Haiku 4.5 via Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves..
New public preview MySQL connector in Lakeflow Connect enables incremental ingestion from Amazon RDS, Aurora, Azure DB for MySQL, Cloud SQL, and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware..
Adds a fully-managed MySQL connector in Lakeflow Connect (Public Preview) to enable incremental data ingestion from MySQL databases
Adds support for five source platforms: Amazon RDS for MySQL, Amazon Aurora MySQL, Azure Database for MySQL, Google Cloud SQL for MySQL, and MySQL on EC2
Databricks introduces Context-based ingress control for workspace access and Gemini 3 Flash as a hosted model.
Adds context-based ingress control in public preview to govern workspace access via identity, network source, and request type policies
Adds Gemini 3 Flash as a Databricks-hosted model with multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. capabilities
Databricks adds Public Preview for fully-managed PostgreSQL connector in Lakeflow Connect
Adds PostgreSQL connector to Lakeflow Connect for incremental data ingestion from Amazon RDS PostgreSQL, Amazon Aurora PostgreSQL, Azure Database for PostgreSQL, Google Cloud SQL for PostgreSQL, and on-premises sources
Databricks Mosaic AI Model Serving adds OpenAI GPT-5.2 via Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves.
Mosaic AI Model Serving now supports OpenAI GPT-5.2 as a Databricks-hosted model
Access the new model via Foundation Model APIs using pay-per-token pricing
New columns added to Lakeflow system tables for enhanced job monitoring in public preview
Adds trigger, trigger_type, run_as_user_name, creator_user_name, paused, timeout_seconds, health_rules, deployment, and create_time columns to the jobs table.
Adds timeout_seconds and health_rules columns to the job_tasks table.
Adds source_task_run_id, root_task_run_id, compute, termination_type, setup_duration_seconds, queue_duration_seconds, run_duration_seconds, cleanup_duration_seconds, and execution_duration_seconds columns to the job_run_timeline table.
Adds compute, termination_type, task_parameters, setup_duration_seconds, cleanup_duration_seconds, and execution_duration_seconds columns to the job_task_run_timeline table.
Vector Search rerankerrerankerA model that re-scores a first batch of search results against the query and reorders them, more accurately than the fast first-stage search. reaches GA to improve retrieval quality.
Adds general availability for the Vector Search reranker capability.
Databricks expands C5 and TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. compliance standards availability to all regions and serverless compute
New policy limiting Open Delta Sharing recipient token expiration to one year
Open sharing recipient tokens are now capped at a maximum expiration of one year from creation.
Tokens with no expiration or longer than one year can no longer be created.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Existing open sharing recipient tokens issued before December 8, 2025, with expiration dates after December 8, 2026, or with no expiration date, automatically expire on December 8, 2026.
New ThreatConnect IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. V3 connector with TQL filtering and THREATCONNECT_IOC_V3 log type replaces v2 integration
Adds a new ThreatConnect IOC V3 connector that ingests Indicators of Compromise via the v3 REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., replacing the v2 integration.
Enables Advanced Filtering with TQL to perform highly targeted searches based on confidence scores, tags, or specific timeframes.
Introduces THREATCONNECT_IOC_V3 as the new log type for identifying data ingested through this connector.
3 details in Everything
1 more release in this issue
· 2025-12-08 → 2025-12-24
RunReveal beta adds Investigations management, saved queries with AI, new Explorer UI controls, custom workspace logos, and 7 data sources.
Adds the Investigations feature in beta for full investigation management including status tracking (open, investigating, closed), severity levels, artifacts, and tagging
Adds a Queries section where users can save queries, share unique URLs, and use AI assistance for query writing or fixing
Adds column selector with decomposed results components to the Explorer UI
Adds a GroupBy dropdown for stacked histograms in the Explorer UI
Adds filter functionality to limit tables to enabled sources only
+10 moreshow less
Adds column reset functionality in the Explorer UI
Adds support for sharable filter settings via URL parameters
Allows uploading a custom logo, accessible at Settings > Workspace Settings > Workspace Logo
Adds Workday as a new polling data source for activity logs
Adds HashiCorp Vault as a new source with audit log ingestion via object storage
Adds AWS Network Firewall as a new source with firewall logs via S3
Adds Formal Security as a new source for data access logs
Adds Linear Webhook as a new source for audit log events
Adds Abnormal Security (polling) as a new alternative polling-based ingestion source
Adds SentinelOne Endpoint Logs as a new source with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs via blob storage and GCS support
VNS 1.0.1584 adds DNS-over-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. traffic monitoring with payload size telemetry.
Adds support for monitoring traffic transmitted using DNS over TCP/UDP
Adds payload size field to telemetry data for DNS traffic
2 details in Everything
24 more releases in this issue
· 2025-12-01 → 2025-12-16
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. Gateway v1.0.76 adds sensitive data upload detection for Microsoft Copilot for M365.
Cloud Risk Management adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Foundations Benchmark v4.0.0, AWS Well-Architected Framework Generative AI Lens support and deprecates old benchmark
Adds CIS Azure Foundations Benchmark v4.0.0 compliance standard support to Cloud Risk Management checks and reports.
Adds support for the AWS Well-Architected Framework Generative AI Lens in the Misconfiguration and Compliance module.
Deprecates CIS Azure Foundations Benchmark v2.1.0 for removal on February 8 2026, preventing new report configurations using this benchmark.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The CIS Azure Foundations Benchmark v2.1.0 compliance standard is deprecated and will be removed on February 8 2026; it will no longer appear in filters, preventing the creation of new reports or report-configurations with this outdated benchmark.
Helm Chart 3.3.1 adds SHA1 to FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. events and displays Falco version in logs
Adds SHA1 hash to File Integrity Monitoring events.
Displays the Falco version in the Falco logs for better debugging.
Trend Vision One adds Microsoft Teams Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. integration to Cloud Email and Collaboration Protection
TrendVision One Endpoint Security agent now supports Ubuntu 24.04 ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.
TrendVision One now supports Isolate Endpoint, Windows event telemetry, and connection telemetry monitoring on Windows 11 ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead..
Adds Isolate Endpoint response action for Windows 11 ARM64 endpoints
TrendAI Vision One Endpoint Security agent for Linux adds Ubuntu 24 ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support
Trend Vision One Cloud Detections for AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. v1.48.0 adds detection support in private VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules..
Trend Vision One introduces the AI Security Blueprint dashboard for unified AI asset visibility
Adds the AI Security Blueprint dashboard to provide unified visibility into AI assets including services, models, workloads, data stores, entitlements, code repositories, APIs, and container images.
New TrendVision One capability allows security teams to assess risks in LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. deployments using the new TMAS CLI.
Adds support for ingesting Azure VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. Flow Logs with TrendAI-powered detection models.
Supports ingestion of Virtual Network (VNet) flow logs in your Azure subscription
Enables TrendAI Vision One to identify malicious IP traffic, SSH brute force attacks, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. from VNet flow logs
Huntress ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. now supports Deny All configuration rules to revoke sessions from outside allowed countries or anonymous VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.
Adds account- and organization-level Deny All location rules that revoke login sessions and disable identities when accessed from outside expected countries
Adds account- and organization-level Deny AllVPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. rules that revoke login sessions and disable identities when accessed via anonymous VPNs
Tines 38.0 introduces MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool integration for AI Agents, Multi Request secret formatting, and new dashboard UI features.
└──▷ HOW TO FIND IT
Connect an AI Agent to a local MCP server via tunnel for secure tool invocation.
📍In the Workflow builder, add an AI Agent action and set its protocol to MCP. Enable the tunnel option to connect to the target agent.
Use Multi Request actions where secret values contain newlines without data corruption.
📍Create a Multi Request node. Configure the credential secrets field; the system now preserves embedded newlines in the stored Workbench memory value.
Investigate tenant health metrics by interacting with dashboard charts directly.
📍Open the Tenant health page in the Tines console. Click on any metric within a Dashboard chart to drill down into the underlying data points.
tunnel support added for AI Agent action when invoking MCP tools
Multi Request credential secrets now preserve newlines in the Workbench memory
Dashboard chart drill-down capability added to the Tenant health page
3 details in Everything
1 more release in this issue
· 2025-12-02 → 2025-12-16
Shuffle v2.1.3 adds Helm-based k8s deployment, auto-enrichment for datastore keys, vendor-neutral AI support, and air-gapped licensing.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.3 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout v2.1.3
Adds auto-enrichment for datastore keys, reducing manual lookup steps in workflows.
Introduces vendor-neutral AI environment variable support and enables AI-powered documentation query answers.
Supports static workflow IDs for more predictable multi-tenant and automation pipeline configurations.
Adds multi-tenant child org workflow execution statistics for better visibility across org hierarchies.
Defaults Kubernetes deployments to Helm charts, streamlining k8s rollout and configuration.
+9 moreshow less
Enables secret deployment via Kubernetes for more secure credential management in k8s environments.
Defaults app replicas to 3 for improved out-of-the-box scalability.
Adds configurable k8s resource limits (CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory) for app and worker containers via Helm.
Supports tmp volume mounting for apps in k8s deployments.
Adds explicit app protocol specification for worker and app services in k8s.
Introduces new licensing features and air-gapped subscription compliance support.
Adds cloud-only billing display options and improved cloud UI sync for subscription data.
Supports flexible subflow streaming and ordering modifications for schedule/deletion logic.
Major OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions./Elasticsearch refactor for v8 compatibility with enhanced health checks.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!The SHUFFFLE_SWARM_CONFIG environment variable is removed from Orborus in k8s deployments.
Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.
tenzir-ship v0.19.0 adds omit_pr and omit_author config keys to disable automatic metadata detection
Adds omit_pr and omit_author configuration options to prevent automatic inference of PR numbers and authors.
Configures the add command to ignore explicitly provided --pr or --author flags when their corresponding omit option is enabled, emitting a warning instead.
2 details in Everything
17 more releases in this issue
· 2025-12-03 → 2025-12-30
Node-level TLS configuration in tenzir.yaml, event-timestamp compaction rules, and deduplicate count_field
Adds centralized tenzir.tls configuration in tenzir.yaml for node-level TLS settings including enable, skip-peer-verification, cacert, certfile, keyfile, tls-min-version, and tls-ciphers
Adds plugins.platform.tls-min-version and plugins.platform.tls-ciphers config keys to control the minimum TLS version and cipher list for connections to the Tenzir Platform
Adds support for mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with.) in server-mode operators with new options tls-client-ca and tls-require-client-cert
Adds count_field option to the deduplicate operator to expose dropped event counts in output events
Adds optional field key to compaction rules to use event timestamps instead of import time for age-based selection
tenzir-ship v0.15.0 adds --no-latest and --commit options to release publish command
Adds --no-latest option to the release publish command to prevent GitHub from marking a release as latest.
Adds --commit option to the release publish command to automatically commit staged changes before tagging, with message configurable via --commit-message or release.commit_message config key.
Splunk Security Content v5.19.0 adds 6 new analytic stories and 31 detections spanning React RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., Tuoni C2, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. DNS coercion, npm supply chain, Shadow AI, and Cisco ASA abuse.
└──▷ GET THIS VERSION
$ git clone --branch v5.19.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.19.0
New React2Shell analytic story (CVE-2025-55182) with detections for suspicious Node.js/React/Next.js child processes on Windows and Linux, plus a network-layer detection via Cisco Secure Firewall Threat Defense Intrusion Events for pre-auth RCE attempts.
New Tuoni C2 Framework analytic story with detections targeting memory-based execution patterns, suspicious process behaviors, and C2 communication indicators across Windows, Linux, and macOS.
New Kerberos Coercion with DNS analytic story (CVE-2025-33073) covering DNS-triggered Kerberos authentication abuse, including detections for short-lived DNS records, DNS-based coercion, and credential target information structures in command lines.
New NPM Supply Chain Compromise analytic story detecting malicious lifecycle hook abuse (preinstall/install/postinstall/prepare), GitHub workflow tampering, credential theft, and Shai-Hulud 2.0 worm campaign exfiltration artifacts.
New NetSupport RMM Tool Abuse analytic story with analytics identifying NetSupport via loaded DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. patterns, executable masquerading, named pipe activity, and registry manipulation to distinguish unauthorized intrusions from legitimate IT use.
+4 moreshow less
New Suspicious Local LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Frameworks (Shadow AI) analytic story with detections for unauthorized Ollama, LM Studio, GPT4All, Jan, llama.cpp, and KoboldCPP deployments via model file downloads (.gguf, .ggml, safetensorssafetensorsA model weight file format that stores only tensors, unlike Python pickle files that can run code when loaded. It is the default on Hugging Face.), process execution, and DNS lookups to model repositories.
Expanded Cisco ASA detection coverage with 11 new analytics covering AAA policy tampering, logging filter and message suppression, packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. activation, device file copy, local user account creation/deletion, privilege level changes, lockout threshold anomalies, and reconnaissance commands.
Added 4 new named-pipe lookups: pua_named_pipes, suspicious_c2_named_pipes, suspicious_named_pipes, and suspicious_rmm_named_pipes to support new Windows named-pipe detections.
Added new executable_extensions macro and updated cisco_snort_ids_to_threat_mapping lookup to support expanded detection logic.
Cribl Stream 4.15.1 adds Azure Gov support for Blob Storage Sources/Destinations and per-process throttling in Cribl HTTP Destination.
Adds Azure Government cloud environment support for Azure Blob Storage Sources and Destinations when using Client secret or Certificate authentication methods.
Enables configuration of a Throttling rate per Worker Process in the Cribl HTTP Destination to limit output volume.
NodeZero December 2025 adds Downstream Impact Type filter, Closed status in VMH, Federal cloud cracking, AD Tripwires archive, and new Rapid Response tests.
Adds Downstream Impact Type filter to the Vulnerability Management Hub to prioritize weaknesses by potential reach
Introduces a user-selectable Closed status in VMH for lifecycle tracking of remediated issues
Enables undoing a status update in VMH to correct accidental data entry errors
Adds a notes pop-up in the Group by Weakness ID view within VMH for quick context viewing/editing
Brings cloud-based hash cracking capabilities to NodeZero Federal environments
+4 moreshow less
Exposes Threat Informed Perspectives as a new capability in NodeZero Federal
Enables Vulnerability Management Hub access for NodeZero Federal customers
Adds the ability to archive deleted domains directly from the Portal for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Tripwires
Updates AD Tripwires Portal UX flows to streamline updates for AD Agent and Event Collector components
Rapid7 Dec 2025: EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. in bulk export APIs, Oracle SID failure threshold config, and new InsightCloudSec integrations
└──▷ TRY IT
Harvest AWS Lake Formation resources to monitor configuration and access controls across your organization.
$ terraform get -update
Adds epss_score and epss_percentile fields to Vulnerability Management (InsightVM) asset and vulnerability bulk export APIs, enabling prioritization by real-world exploit probability.
Adds new Oracle SID enumeration failure threshold mechanism with configurable custom properties com.rapid7.oracle.bootstrap.failure.limit and com.rapid7.oracle.bootstrap.failure.codes in the Scan Engine.
Adds LakeFormationHarvester for harvesting AWS Lake Formation resources and requires the lakeformation:GetDataLakeSettings permission in Cloud Security (InsightCloudSec).
Adds new AliCloud Python onboarding script exposed via API endpoints in Cloud Security (InsightCloudSec) for streamlined cloud account onboarding.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The query filter field names full_tls_10, full_tls_11, full_ssl_30, and full_tls_12 have been removed from the RestAPI resource in InsightCloudSec, replaced by client_tls_*, backend_tls_*, and client_ssl_* fields.
!The query filter named App Stream Fleet Not Using VPC (AWS) has been renamed to App Stream Fleet Not Using Securely Configured VPC, affecting any automation referencing the old name.
!The query filter Database Instance Vulnerability Assessment Not Associated with Storage Account and its associated insight have been deprecated and removed from all compliance packs in InsightCloudSec.
Vuls v0.37.0 adds support for the EU Vulnerability Database (EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories.) as a detection source.
└──▷ GET THIS VERSION
$ git clone --branch v0.37.0 https://github.com/future-architect/vuls.git
# already have the repo? check out this version:$ git checkout v0.37.0
1 more release in this issue
· 2025-12-01 → 2025-12-09
DefectDojo 2.53.5 introduces reimport validation and fixes import parsers for BlackDuck, Tenable, and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence..
└──▷ GET THIS VERSION
$ git clone --branch 2.53.5 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.53.5
Adds test_type mismatch validation during reimport to prevent data inconsistency
Updates Docker image management strategy from dependabot to renovate
2 details in Everything
4 more releases in this issue
· 2025-12-01 → 2025-12-29
DefectDojo 2.53.4 adds configurable tag truncation, Argo-friendly HPA, and metrics now use mitigated_date for closed findings.
└──▷ GET THIS VERSION
$ git clone --branch 2.53.4 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.53.4
Adds configurable tag truncate length via settings.dist.py / local_settings.py.
Metrics now use mitigated_date for closed findings in both the API and UI, giving more accurate closure timestamps.
Makes Helm HPA configuration more Argo-friendly for GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. deployments.
Adds a start-up checker for the broker to verify connectivity on launch.
Twistlock parser now uses discoveredDate for the finding date.
+1 moreshow less
SonarQube parser now uses creationDate for the finding date.
DefectDojo 2.53.1 adds AND logic for tag filtering and a new fix_available field for Legitify findings.
└──▷ GET THIS VERSION
$ git clone --branch 2.53.1 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.53.1
└──▷ HOW TO FIND IT
Use AND tag filtering to narrow findings to those matching all selected tags at once — useful for triaging findings that belong to multiple categories or teams.
📍In the Findings list, apply multiple tag filters; the UI now evaluates them with AND logic so only findings matching all selected tags are returned.
Adds AND logic for tag filtering in the UI, enabling more precise finding searches across multiple tags simultaneously.
Adds fix_available field to Legitify scan report imports, surfacing remediation availability directly in findings.
DefectDojo 2.53.0 adds new parsers, fix_available fields across scanners, JIRA retry/rate limiting, OpenReports import, and API enhancements.
└──▷ GET THIS VERSION
$ git clone --branch 2.53.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.53.0
New Zora vulnerability parser with fix_available field support.
New ThreatMapper file format parser for the updated ThreatMapper output.
New n0s1 scanner parser.
New OpenReports import support.
Adds fix_available field to Kubeaudit, Dawnscanner, IBM App, PWN SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., and Zora parsers; reimport now updates fix_available in existing findings.
+10 moreshow less
Implements CERTFR vuln ID and VA vuln ID parsing.
Qualys XML parser now maps CVEs to Vulnerability IDs.
JIRA integration gains retry and rate-limit support.
Adds API choice fields for business criticality, platform, lifecycle, and origin on products.
API now sends a notification when a finding is created via the API.
Social auth exceptions are now configurable via settings.
Adds SOCIAL_AUTH_REDIRECT_IS_HTTPS setting to force HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. redirects after social-auth login.
Deduplication of findings now runs in batches for improved scalability.
Helm chart gains Horizontal Pod Autoscaler (HPA) and Pod Disruption Budget (PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis.) support.
System settings caching optimization reduces database load.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!The Helm chart now uses Valkey instead of Redis (feat(helm): Use Valkey); existing Redis-based Helm deployments will break on upgrade.
Adds dynamic asset tagging, IEC 61850 support, Genetec VMS integration, and EM role sync to OT Exposure.
Adds rule-based dynamic asset tagging using filters like type, risk score, or criticality
Adds automatic synchronization of Enterprise Manager (EM) ICP-Access user groups for role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
Adds Saved Filters functionality on the Inventory, Findings > Vulnerability, and Findings > Policy Violations pages
Adds Resource Center section within Enterprise Manager interface
Adds support for passive detection and classification of IEC 61850 protocol traffic for electrical substation visibility
+5 moreshow less
Adds new compliance dashboard mapping for IEC 62443-3-3 and NIST-CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. frameworks
Enables viewing Tenable One OT Exposure policy violations directly within Tenable Security Center dashboards
Adds infrastructure support for feature flags to enable or disable specific features dynamically
Adds Genetec Video Management System (VMS) integration via Remote API
Adds filtering on Asset ID field across Asset Inventory and Findings interfaces
10 details in Everything
9 more releases in this issue
· 2025-12-03 → 2025-12-18
New ServiceNow ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. ticketing integration for automated remediation workflows in Tenable Exposure Management.
Adds automatic ticket creation for data mobilization via a new ServiceNow ITSM integration
New Read-Only role and custom roles for Tenable Exposure Management in RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. update
Adds a Read-Only role to Tenable Exposure Management that restricts users to viewing and drilling down into data without affecting it.
Adds a new custom role capability for Tenable Exposure Management to consolidate access controls into a single location.
New Read-Only and custom RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles with tag enforcement and Inventory section disablement in Tenable Exposure Management.
Adds a new Read-Only role for viewing and drilling down into data without affecting it, scrubbing action-related elements from the UI
Introduces a new custom role for consolidating access across different areas within Tenable Exposure Management for granular control
Enables tag enforcement allowing tags created in Tenable Exposure Management to be available on the Permissions page in Tenable One Vulnerability Management
Adds ability to disable the Inventory navigation item, removing its widget from the Home page and related fields/tabs from Asset Details
Tenable Security Center 6.7.2 adds improved upgrade workflow for non-critical failures and requires manual IP range entry for DNS assets in offline universal repositories.
Allows non-critical upgrade failures to complete with a warning and in-product instructions instead of aborting
Requires manual entry of the IP range when editing an offline universal repository to enable DNS assets after upgrading from 6.6.x or earlier
New Claroty xDome OT connector and in-dashboard widget editing for Tenable Exposure Management
Adds the Claroty xDome third-party connector to pull asset and findings data from OT devices
Enables direct editing of built-in and custom widget configuration parameters (Widget Type, Categories, Values, Data Labels, Stacking, Filters) within dashboards
Excludes SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. output format from packagedeprecation results
Tenable Nessus Manager now generates plugin databases for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence.-derived distributions.
Automox adds two new base worklets for macOS: JAMF Install OS Updates and JAMF List Software Plans to handle Secure Token constraints and visibility.
Adds the JAMF Install OS Updates base worklet that initiates first-party macOS updates via JAMF's MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. workflow using an escrowed Bootstrap Token, bypassing local Secure Token requirements
Adds the JAMF List Software Plans base worklet to list executed JAMF software update plans for validation and visibility
2 details in Everything
2 more releases in this issue
· 2025-12-11 → 2025-12-18
Automox console now reflects Microsoft's new Windows 24H2 update title format (Security Update).
Updates displayed in the Automox console now use Microsoft's updated naming convention for Windows updates (e.g., Security Update instead of Cumulative Update).
Patch policies relying on name-based criteria may require adjustment to accommodate the new metadata format.
New Device Explorer with unlimited query criteria, new API endpoints, and direct device management actions in the UI.
Adds read and manage permissions for the new query capability
Removes the previous limitation of 10 criteria per query, enabling unlimited search criteria
Breaks out attributes by scope (Device, Disks, NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link., IP Address, Software, Tags) with smart type-ahead
Adds ability to apply tags, remove tags, 'assign to a group' and delete a device directly from the results table
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Existing device explorer queries will not be migrated and will be removed with the enablement of the new enhancements
!Custom roles created prior to the release need to be manually updated to include the new query permissions if desired
Windows Package Manager v1.12.440 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support and experimental font management capabilities
└──▷ GET THIS VERSION
$ git clone --branch v1.12.440 https://github.com/microsoft/winget-cli.git
# already have the repo? check out this version:$ git checkout v1.12.440
└──▷ TRY IT
Run the embedded MCP server to assist with client configuration via MCP protocol.
$ winget mcp
Search for fonts using the new dedicated source.
$ winget search font -s winget-font
Adds winget mcp command to expose an MCP server for client configuration assistance
Adds Font as a supported value for InstallerType and NestedInstallerType in manifest schema v1.12
Adds winget-font source for searching and managing fonts
Adds --details argument to the winget font list command for extended view output
Fleet 4.78.0 adds Android setup experience, Windows manual MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. enrollment, Okta conditional access UI, and certificate template GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. support.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.78.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.78.0
└──▷ HOW TO FIND IT
Set up Okta conditional access integration so that Fleet can gate resource access based on device compliance status.
📍In the Fleet UI, go to Settings -> Integrations -> Conditional access and configure your Okta conditional access settings.
Adds Android self-service app support to fleetctl gitops.
Adds Android systemUpdate profile support.
Adds ability to create, view, and delete Google Play Store software for Android in the UI.
Adds $FLEET_VAR_HOST_PLATFORM variable for Apple platforms (macos, ios, ipados) in profiles.
+15 moreshow less
Adds support for installing setup-experience VPP apps on manually-enrolled iOS/iPadOS devices.
Adds ability to deploy user-scoped SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. profiles for Windows hosts.
Adds configuration option to require Windows users enroll into MDM manually via work or school account rather than automatic enrollment.
Adds UI to allow Windows hosts to manually enroll into Fleet MDM.
Adds support for $FLEET_VAR_HOST_HARDWARE_SERIAL and $FLEET_VAR_HOST_PLATFORM variables in Windows profiles.
Adds activity filtering on the Fleet dashboard page.
Adds Okta conditional access configuration to Fleet UI under Settings -> Integrations -> Conditional access.
Adds endpoint for hosts to update certificate status.
Adds detail column to host_certificate_template table and certificate_templates property with GitOps support.
Adds MDM-enrolled Android devices receiving certificate templates via managedConfigurations.
Makes host_count property optional in GET /labels API endpoints, improving performance for large label queries.
Allows users to save Fleet queries even when SQL is flagged as invalid by the Fleet UI.
Returns pre-install query output in the Install Details modal.
Translates idp to mdm_idp_accounts on API responses.
Adds Mosyle to the list of well-known MDM platforms.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!Fleet is no longer verified to work with Redis 5 or below; configurations referencing Redis 5 have been switched to Redis 6. Deployments using Redis 5 or earlier must upgrade Redis before upgrading Fleet.
!The idp field in API responses is now returned as mdm_idp_accounts; any integrations parsing the idp key from API responses will need to be updated.
1 more release in this issue
· 2025-12-02 → 2025-12-19
Fleet 4.77.0 adds JetBrains plugin vuln detection, Custom EST/SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. CA support, iOS self-service IPA apps, and BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. macOS auth improvements.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.77.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.77.0
└──▷ HOW TO FIND IT
Configure a Custom EST certificate authority so Fleet can issue certificates through your internal PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets..
📍In the Fleet UI, go to Settings › Integrations and add a Custom EST certificate authority with your EST server URL and credentials.
Detects vulnerabilities in JetBrains IDE plugins.
Adds activity log entries for host deletion, host expiration, and updating or deleting host IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. mappings.
Updates MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. enrollment flow for BYOD macOS hosts to require end-user authentication before downloading the MDM profile via the My device page.
Adds self-service install support for custom IPA apps on iOS and iPadOS.
Adds support for in-house (.ipa) apps to fleetctl gitops.
+9 moreshow less
Adds support for Custom EST certificate authorities.
Adds ability to deploy certificates from Custom SCEP certificate authorities on Windows.
Updates POST /setup_experience/script endpoint to allow updating the macOS setup experience script in-place (GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. no longer calls DELETE).
Adds status counts to batch script detail page tabs.
Adds ingestion of upgrade_codes from Windows software, exposed via all relevant software endpoints.
Adds experimental FLEET_MDM_ENABLE_CUSTOM_OS_UPDATES_AND_FILEVAULT configuration to deploy custom OS settings including FileVaultFileVaultApple's full-disk encryption feature built into macOS, using XTS-AES-128 to encrypt the startup volume so that data is unreadable without the user's credentials. payloads and macOS/Windows update settings.
Adds ability to change software display names in the UI.
Moves end-user authentication SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. settings under Integrations > SSO in global settings.
Adds InstallAnywhere as a recognized self-extracting archive for PE metadata extraction.
runZero 4.0.251208.0 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale.-based LLDP capture and fixes stale software counts.
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager Dec 2025 adds SweetShow and Addigy v2 APIs, Jira 'raise on behalf of', and admin settings for app requests
Adds Sweet Show integration with support for Groups, Users, User roles, User activity, Provisioning, and Deprovisioning
Updates Addigy integration to v2 API, adding Users and Device actions (wipe, lock, shutdown, restart)
Enables Jira 'raise on behalf of' parameter to select a specific Person for automated tasks
Adds new settings view for configuring app request recipient notifications
JumpCloud adds forced re-auth support, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. claims, sso_auth logs, and GA of AI Commands Builder
prompt=login (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.) and ForceAuthn="true" (SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.) are now honored to trigger forced re-authentication for high-stakes actions without logging users out.
AMR claimsAMR claimsAssertions made by a CPU about its own current operating mode and privilege level, used by attestation systems to verify that code is running in a trusted execution environment. are included in SAML assertions and OIDC ID tokens to verify multi-factor verification at the point of access.
A new sso_auth event is captured in logs specifically for forced re-authentication events.
The JumpCloud Admin Portal now includes the generally available AI Commands Builder to create commands for Windows, macOS, and Linux using natural language.
Adds Shadow AI Dashboard and expands generative AI app coverage for visibility
Adds the Shadow AI Dashboard for dedicated UI-based management of generative AI usage.
Expands coverage to include a wider range of generative AI apps in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. monitoring.
Ory Hydra adds strategies.jwt.stateless.enabled flag to issue stateless JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage., reducing DB load.
└──▷ USE IT
Validate if your Keto deployment uses the deprecated legacy WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. namespace watching that needs migration.
Adds strategies.jwt.stateless.enabled and strategies.jwt.stateless.claim_name to disable database persistence for JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. in Ory Hydra
Removes support for watching WebSocket URLs (ws://) for legacy namespace configuration in Ory Keto
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Ory Keto no longer supports watching WebSocket URLs (ws://) for legacy namespace configuration; the namespaces configuration field is affected when using deprecated legacy namespaces. Migrate to the Ory Permission Language.
Topaz v0.33.0 adds AuthZENAuthZENAn OpenID Foundation working group specification that standardises the API between policy enforcement points and policy decision points, letting cyber tools swap authorization engines without rewriting integration code. evaluation assertions to templates and builtins, updates OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. draft support.
└──▷ GET THIS VERSION
$ git clone --branch v0.33.0 https://github.com/aserto-dev/topaz.git
# already have the repo? check out this version:$ git checkout v0.33.0
Adds AuthZEN evaluation assertions to policy templates for stricter verification during access checks
Adds new authzen access service builtins available in policy logic
Updates the OpenID AuthZENOpenID AuthZENAn emerging standard from the OpenID Foundation that defines a common API for querying authorization engines, letting cyber tools swap policy decision points without rewriting integration code. implementation to the latest draft v0.1.0-05
Nudge Security is a SaaS security platform that discovers shadow IT assets, manages identity governance, and hardens security posture.
Default table sorting now prioritizes high-risk and spend items at the top for faster triage.
Updates default sort order so clicking risk, spend, or MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. status columns places highest values first.
1 detail in Everything
2 more releases in this issue
· 2025-12-08 → 2025-12-29
Nudge adds Browser Extensions tab to App-to-App Integrations for organizational inventory of browser extensions.
Adds the Browser Extensions tab within the App-to-App Integrations section of the product to view detailed insights into extension landscape at user and extension level.
Enables identification of high-risk and outdated browser extensions across supported browsers.
Nudge Security adds monitoring for sensitive data shared in AI chatbot conversations (ChatGPT, Claude, Gemini, etc.)
Adds detect-sensitive-data-shared-in-ai-chatbot-conversations capability to monitor secrets, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., and financial/healthcare data in AI chatbot tools.
Exposes copy/paste activity source detection for AI conversation monitoring.
Provides file upload metadata (name, source, size, type) capture for AI conversations.
Adds Browser Extension Settings interface for configuring detection settings and data storage preferences.
Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.
Commvault Cloud December 2025 adds Air Gap Archive tier, CrowdStrike SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration, Azure NVMe support, and bulk restore-to-blob for M365 workloads.
Adds Air Gap Protect Archive storage tier for low-cost, long-term retention of 180+ days
Integrates with CrowdStrike Next-Gen SIEM to deliver telemetry on anomaly detection, malware identification, encryption activity, and sensitive data exposure
Enables attaching or repaving disks from backed-up VMs to new Hyper-V virtual machines
Adds support for backing up Azure VMs with NVMe-controller storage
Enables unified onboarding wizard for File Servers across software and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally.
+13 moreshow less
Introduces Onboarding wizard for S3 Compatible storage separate from Amazon S3
Allows restricting cross-region backups for GCP Compute to the same region as the VM
Enables VMware Agentless File Restore via CyberArk One-Time Credentials
Supports auto-discovery and protection plan assignment for Amazon Aurora and RDS databases
Supports auto-discovery and protection plan assignment for Amazon DynamoDB tables
Adds Point-in-Time Recovery (PITR) support for GCP BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data.
Enables NVMe Disk Controller Support for Azure VM Restores and HotAdd Operations
Introduces Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. Live Mount to access VMs directly from backup storage
Adds Endpoint In-Place Legal Hold for laptop backup data in SaaS Applications and Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
Adds User Principal Name (UPN) provisioning from Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. for Druva Endpoints
Enables user provisioning and management via User Principal Name (UPN) from Active Directory environments
Allows preventing conflicts from overlapping email attributes by using UPN-based provisioning across multiple AD environments
2 details in Everything
11 more releases in this issue
· 2025-12-01 → 2025-12-27
inSync Client v8.0.0 for Windows adds self-healing auto-recovery and enhanced security structure.
inSync Client v8.0.0 for Windows now features a self-healing mechanism that automatically detects and recovers from stuck or inconsistent states to ensure uninterrupted backups.
inSync Client v8.0.0 introduces an enhanced security structure for stronger protection and adherence to higher security standards.
Agentless Azure Files protection and centralized cloud storage provisioning for Enterprise Workloads.
Introduces Agentless data protection for Azure Files (SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. shares) with immutable, zero-infrastructure backups stored in Druva Cloud.
Enables provisioning of new Druva Cloud Storage instances directly from the Management ConsoleStorage page with status tracking for Requested and Provisioned states.
Expands support for Druva Azure Cloud Storage as a backup target for Azure Files, Oracle Phoenix Backup Storage (PBS), Microsoft SQL Server, and Virtual Machines via CloudCache R4.
Druva adds agentless Azure Files protection, centralized storage provisioning, and GovCloud Messenger support
Introduces agentless, zero-infrastructure data protection for Azure Files SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. shares with immutability and zero egress fees
Adds ability to provision new Druva Cloud Storage requests directly from the Management Console Storage page with status tracking
Expands Druva Azure Cloud Storage support to Oracle Phoenix Backup Storage, Microsoft SQL Server workloads, and VM Instant Restore via CloudCache R4
Supports Central India as a storage region for Enterprise Workloads Azure Cloud Storage backups
Makes Messenger available on AWS GovCloud (US) for in-product support and knowledge base access
+1 moreshow less
Updates Azure Blob Storage UI to group Backup Sets under Storage Accounts and adds an All Containers tab
Kopia is an open-source backup tool for Windows, macOS, and Linux with incremental snapshots, client-side end-to-end encryption, compression, and deduplication, with both a CLI and a GUI.
Kopia v0.22.3 adds option-passing support for the local filesystem snapshot source.
└──▷ GET THIS VERSION
$ git clone --branch v0.22.3 https://github.com/kopia/kopia.git
# already have the repo? check out this version:$ git checkout v0.22.3
Acronis Cyber Infrastructure is hyperconverged software that pools storage, compute, and networking on commodity servers, often as a backup storage target.
Acronis Cyber Infrastructure 6.2.1-97 enables single-step upgrades from 6.2.1 to the latest version.
└──▷ HOW TO FIND IT
Apply the update without intermediate steps when running 6.2.1 or later — navigate to the updates section in the admin panel.
📍In the admin panel, go to SETTINGS › UPDATES, place nodes in maintenance mode, then initiate the update to upgrade directly to the latest available version in a single step.
Clusters running version 6.2.1 or later can now upgrade directly to the latest available version in a single step, eliminating intermediate update hops.
Use Azure Key Vault Secrets as the KDR passphrase provider so the Disaster Recovery passphrase is stored and retrieved from Azure Key Vault rather than managed manually.
📍In the Kasten dashboard, go to Settings › Disaster Recovery, select Azure Key Vault as the passphrase provider, and enter your Key Vault name and secret name to enable passphrase storage and retrieval.
Adds remote_write support for Prometheus to forward Kasten metrics to external endpoints such as Grafana Cloud, Datadog, or other Prometheus-compatible systems.
Adds Azure Key Vault as a passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. provider for encryption key management, enabling envelope encryptionenvelope encryptionEncrypting data with a fresh data key, then encrypting that key with a master key held in a KMS. Rotating the master key never means re-encrypting the data. of the primary key.
Adds Azure Key Vault Secrets as a passphrase provider for Disaster Recovery, allowing KDR passphrase storage and retrieval from Azure Key Vault.
Adds search to the Kasten dashboard for quick navigation to specific policies, profiles, and application namespaces by name.
Backups exported to a Veeam Backup & Replication (VBR) repository now include Kubernetes application metadata captured by the policy; policies exporting to VBR still require an additional Kasten location profile for storing each application's Kubernetes metadata.
+1 moreshow less
Improves job throughput under load after reaching concurrency limits defined by limiter.*PerCluster Helm values.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The k10restore Helm chart and k10restore OpenShift operands have been removed; alternate recovery options are documented under Veeam Kasten Disaster Recovery.
Adds Malsite Severity attribute to Alerts data collection for Advanced Analytics consistency
└──▷ BREAKING ON UPGRADE
!The previous alert attribute is renamed to Malsite Severity (Deprecated) and will be retired, requiring manual replacement in Personal or Group dashboards.
Updates to AI Usage Dashboard filtering logic and widget configuration.
The Category dashboard filter now uses the Category field directly instead of the Other Category field.
Widgets Percentage of Users Accessing AI Apps and Percentage of Users Querying AI Apps now support custom dimensions via the AI Users dimension for targeted filtering.
Netskope R133 adds AI Red Teaming, Guardrails, SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. instance connectivity visibility, and Windows 64-bit client steering.
Adds AI Red Teaming capability for adversarial testing of AI models.
Adds AI Security Guardrails to enforce safety policies on AI interactions.
Adds Netskope AI Gateway as a new integration point for securing AI traffic.
Provides visibility into connectivity between SaaS App Instance and SSPM.
Netskope v133 adds AI Gateway Red Teaming/Guardrails, Enterprise Browser Extension Governance API, NG API DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Owner/ChatGPT controls, and NPA Source IP policy criteria.
Adds AI Gateway beta for intercepting app-to-AI model traffic with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. authentication, rate limiting, and DLP
Adds AI Red Teaming beta to simulate adversarial attacks against LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.
Adds AI Security Guardrails beta inline module for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools./jailbreak detection using MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling./OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 LLM mapping
Adds New MCP Server Category for identifying public MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers in Real-time Protection policies
Adds Owner attribute support in Next Generation API Data Protection policy definitions for Google Drive and Microsoft 365 SharePoint files
+24 moreshow less
Adds Rows row-range selection (From/To) for Next Generation inventory CSV export to handle multi-million record sets
Adds Last Acting User and Last Modifier options to Next Generation API Data Protection notifications for targeted alerts on file activity
Adds Generative AI scan content type criterion with fine tuning data and memory options for ChatGPT Enterprise protection
Adds Multi-Geo Support for OneDrive and SharePoint in Next Generation API Data Protection with new Region field on Inventory page
Adds Enterprise Browser Extension Governance via API endpoint [API-GW Host]/configpolicies to control extensions by User Group or OU
Adds Service Objects API at /api/v2/profiles/serviceobjects for granular port-based SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. policies in controlled GA
Adds match_context field (e.g., layer7) to POST /api/v2/nsiq/urllookup responses
Adds hidePopupMDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. setting for Netskope Chrome Extension to suppress notification pop-ups
Adds Source IP (Egress IP) as a policy criteria for NPA applications steered via Client
Adds Per-App Authentication timer configuration for Real-time Policy Framework in NPA
Adds Enforce Enrollment Beta feature to mandate Netskope Client installation before web access
Adds Controlled GA of Windows 64-bit Client Support with UI toggle for 32/64-bit architecture during upgrade or invitation
Adds Google Advertising ID (GAID) display on Devices page for Android devices
Adds Support for ChromeOS 142 in Netskope Client
Adds General Availability of Support for Omnissa Horizon for Persistent VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. environments
Adds CRL Check Validation Beta support for macOS device classification
Adds Enhanced Reports (New Experience) General Availability for FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data./PBMM environments
Adds RBI and Enterprise Browser Interoperability allowing EB as an Access Method in Isolate Policy rules
Adds Visibility of Connectivity Between SaaS App Instance and SSPM with real-time status badges and error messages
Adds Status Changed Since timestamp in SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Findings Report exports for failed findings
Adds 15 new SSPM Predefined Rules covering AzureAD, GitHub, M365, Slack, Workday, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior., and Security Domains
Adds 1 new SSPM Predefined Template for Salesforce
Adds Cloud Explicit Proxy (CEP) HTTPS steering method available via API
Adds Netskope Personnel Tenant Access UI for granting explicit, time-limited support access to tenants
29 details in Everything
└──▷ BREAKING ON UPGRADE
!The POST /results/gethistory, GET /results/stats/byappsuite, POST /results/resources/export/getdata, POST /results/rules/export/getdata, and POST /results/thirdpartyapps/export/getdata SSPM API endpoints are removed.
!Configuration via the deprecated Browser Configurations endpoint /api/v1/browserconfigs must be migrated; it will stop being managed in WebUI after May 1st, 2026.
Bytebase 3.13.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration, Workload Identity for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., and Microsoft Teams direct messages.
└──▷ GET THIS VERSION
$ git clone --branch 3.13.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.13.0
└──▷ USE IT
Update Terraform SQL review rules to use the new typed payload fields after the generic payload and comment fields are removed.
hcl
resource "bytebase_sql_review" "prod_policy" {
name = "projects/my-project/sqlReviews/prod"
environment = "environments/prod"
rule {
type = "column.max-columns"
level = "SQLReviewRule_WARNING"
number_payload {
value = 20
}
}
rule {
type = "naming.table"
level = "SQLReviewRule_ERROR"
naming_payload {
format = "^[a-z][a-z0-9_]*$"
max_length = 63
}
}
}
Adds approval_flow.rules.flow inside bytebase_setting (settings/WORKSPACE_APPROVAL) for Terraform-managed approval flows, replacing risk resources; see approval_flow.tf.
SQL review rules in Terraform now use typed payload fields — number_payload, string_payload, string_array_payload, naming_payload — replacing the generic payload and comment fields.
Adds risk.level as an optional CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. factor for CHANGE_DATABASE approval flows.
Renames MaskingException to MaskingExemption in APIs; replaces the member field with a members list; removes the action field; renames Terraform resource masking_exception_policy to masking_exemption_policy.
Changes user references from users/{id} to users/{email} across APIs and storage; audit logs now store user emails directly.
+15 moreshow less
Adds MCP integration support.
Adds Workload Identity as a dedicated account type for OIDC-based authentication, with GitHub Actions support.
Supports direct messages for Microsoft Teams.
Moves rollout policy checkers (Require issue approval and Plan check enforcement) from environment level to project level.
Removes the reason field from BatchRunTasks and BatchCancelTaskRuns batch task APIs (reason is now supported only for skip operations).
Applies Disallow Copy Policy to Admin and DBA roles, which were previously exempted.
Consolidates DDL and DML changes so users no longer need to select them explicitly when initiating a New Plan or configuring an approval flow.
Approval flows are now defined directly using CEL expressions, without intermediate risk definitions.
Refines database group permissions: roles with bb.projects.get gain bb.databaseGroups.list/get; roles with bb.projects.update gain bb.databaseGroups.create/update/delete.
Adds event trigger sync and SDL support for PostgreSQL.
Supports TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. for Trino.
Supports passphrase-protected private keys for Snowflake.
Adds timeline view, auto-expanded task details, and collapsible task run logs with auto-refresh on the rollout page.
Allows filtering in SQL Editor results to quickly locate rows.
Allows selecting a database group to query from in the SQL Editor.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!User references change from users/{id} to users/{email} in all APIs and storage; any integration or script using users/{id} format will break.
!The action field is removed from MaskingExemption (formerly MaskingException) in APIs.
!MaskingException is renamed to MaskingExemption in APIs; the Terraform resource masking_exception_policy is renamed to masking_exemption_policy.
!The member field in masking exemption APIs is replaced with a members list.
!The reason field is removed from BatchRunTasks and BatchCancelTaskRuns; reason is now only supported for skip operations.
!SQL review rule level enums change from SQLReviewRuleLevel_WARNING/ERROR to SQLReviewRule_WARNING/ERROR in Terraform.
!Generic payload and comment fields are removed from SQL review rules in Terraform; typed fields (number_payload, string_payload, string_array_payload, naming_payload) must be used instead.
!For Terraform approval flows, risk resources are removed; approval flows must be defined via bytebase_setting (settings/WORKSPACE_APPROVAL) using approval_flow.rules.flow.
!Database group permissions are now tied to bb.projects.get and bb.projects.update; custom roles in Terraform must be updated accordingly.
!Disallow Copy Policy now applies to Admin and DBA roles, which were previously exempted.
!Rollout policy checkers (Require issue approval, Plan check enforcement) have moved from environment to project level; existing configurations are migrated automatically.
!Schema Template functionality is removed.
1 more release in this issue
· 2025-12-04 → 2025-12-18
Cyera adds continuous mapping of risks and configurations to regulatory frameworks like GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., and PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers.
Introduces capability to continuously map risks and configurations to regulatory frameworks (GDPR, SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2, PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly.-DSS, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., NIST)
Enables prioritization of high-impact issues for compliance based on the new risk-mapping model
Provides a shared view of compliance posture with real-time updates to keep evidence current
Zscaler EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds a phishing alert icon on the Lookalike Domains tab and Insights widget.
Adds a phishing alert icon to the Lookalike Domains tab for detected lookalikes
Displays phishing alert count in the Top 5 Lookalike Domains by Exposure widget on the Insights Overview dashboard
2 details in Everything
37 more releases in this issue
· 2025-12-01 → 2025-12-31
Adds SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. Platform Script Editor testing component and limited-availability Endor Labs connector
Adds Test Logic panel in the Script Editor to run Python mapping logic against sample records for validating transformations.
Adds Endor Labs connector in limited availability to retrieve SCA, container, secrets, and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings from specific namespaces using the Query API.
UVM adds failure alert notifications for ETL/workflows and limited availability GitHub Advanced Security and Ionix connectors.
Enables email notifications for errors in outegration workflows, source run failures, and ETL/data pipeline issues.
Adds a GitHub Advanced Security - Code Scanning connector to retrieve code scanning data from GitHub repositories.
Adds a GitHub Advanced Security - Secret Scanning connector to retrieve secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. data from GitHub repositories.
Adds an Ionix connector supporting Assets and Findings streams with incremental data synchronization.
Adds Zscaler Deception entitlement support, tunnel PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. download, registry key posture profiles, and VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass subdomain control.
Adds Zscaler Deception service entitlement for Authentication Service tenants as a supported feature
Updates forwarding profile to download the PAC file through the tunnel (Tunnel mode) instead of directly
Updates VPN Gateway Bypass to optionally not bypass subdomains for FQDNs
Adds support for REG_BINARY type in Registry Key device posture profiles
Updates Zscaler Client Connector to monitor system-level proxy configuration changes and enforce settings based on forwarding profile
Adds failure alert notifications for ETL and connectors; limited availability GitHub Advanced Security and Ionix connectors.
Enables email notifications for errors in outegration workflows, source run failures, and ETL/data pipeline issues via Enabling Email Notifications for Failures
Adds GitHub Advanced Security - Code Scanning connector to retrieve code scanning data including vulnerabilities and misconfigurations
Adds GitHub Advanced Security - Secret Scanning connector to retrieve secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. data including exposed API keys, credentials, and tokens
Adds Ionix connector for Assets and Findings streams, supporting incremental synchronization and CVE-level details with remediation actions
Client Connector 4.7.0.168 adds REG_BINARY support for device posture profiles and monitors system proxy changes.
Adds support for using registry keys with the REG_BINARY type with the Registry Key device posture profile
Updates Zscaler Client Connector to monitor changes to the system-level proxy configuration and to enforce the Zscaler proxy settings based on the forwarding profile
ZPA adds CentOS/RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. platform filters for connectors, machine tunnel user dashboard widget, and RPM updates for RHEL 8/9
Platform filter allows searching App Connector and Private Service Edge pages for obsolete CentOS 7 or RHEL 8/9 package versions
Users Dashboard supports a Machine Tunnel Widget showing top 10 users by machine tunnel activity
Updated Manager software version 25.50.4 provides RPM packages for App Connectors, PSEs, Private Cloud Controllers, and Network Connectors on RHEL 8.x/9.x
ZIA adds new API pagination params, log fields, Atlassian AI controls, and adjustable scan intervals.
Adds page and pageSize query parameters to the GET /urlFilteringRules API endpoint for paginated rule retrieval
Adds %s{zs_rcv_time} and %s{zs_sent_time} fields to NSS/Cloud NSS feed output formats for email received/sent timestamps
Adds Embedded AI and Embedded AI Prompts fields in the Add/Edit Productivity and CRM Tools rule window for Atlassian apps to control embedded AI access and prompt storage
Adds adjustable polling interval configuration for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application scan schedules under Policy > SaaS Security > Scan Configuration > Add Scan Schedule
Extends DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. quarantining support to Box, Dropbox, Confluence, ShareFile, and Smartsheet with the new Admin Quarantine action in the Edit DLP Rule window
+2 moreshow less
Adds ability to scope SaaS Security Data at Rest Scanning DLP policies by number of internal and external collaborators for file sharing apps
Updates POST /auditlogEntryReport and POST /eventlogEntryReport endpoints to return HTTP 200 with a statusId instead of 204, requiring script updates to capture and pass statusId for subsequent status/download/cancel requests
7 details in Everything
└──▷ BREAKING ON UPGRADE
!POST /auditlogEntryReport and POST /eventlogEntryReport now return HTTP 200 with a statusId instead of 204, requiring scripts to parse the statusId from the response and pass it as a query parameter to subsequent requests for checking status, downloading reports, or canceling requests
ZPA adds CentOS/RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. platform filtering for connectors and a Machine Tunnel widget to the Users dashboard.
Adds Platform filter on App Connectors and Private Service Edges pages to search for obsolete CentOS 7 (el7) or identify RHEL 8/9 (el8/el9) package OS versions
Adds Machine Tunnel Widget to the Private Access Users dashboard displaying top 10 users by tunnel usage for a selected time frame
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds GCP BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. support, AI Inventory risk filters, and on-prem scanner init command
Adds new filter fields (e.g., LLM Safety & Societal Impacts Risk, Model Supply Chain Risk) in the AI Inventory interface for models and AI Tools & Packages.
Adds a single initialization command for deploying on-premises scanners from OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. or VHD images.
Adds data discovery support for Azure Germany North region during account onboarding.
Adds new posture labels (Logging, Encryption, Public Exposure) for unmanaged MongoDB, GCP BigQuery, and AWS Databricks resource types.
Adds new detection policies for AWS Bedrock, Azure Storage, On-Premises Oracle, Snowflake, and Azure Databricks regarding sensitive data access risks.
Client Connector 4.7.0.87 adds process path app identification and tunnel PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. download for macOS.
Adds support for using a process path for application identification in custom VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. profiles to handle apps missing Team Identifiers
Adds support to download the forwarding PAC file through the tunnel when in Tunnel mode
ZDX Module 4.5.0.44 adds hardware ID to device telemetry and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support.
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds GCP BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. and Azure Germany North data scanning, new AI Inventory risk filters, on-prem scanner init command, and dozens of new posture policies
Adds data discovery, classification, and posture scanning for GCP BigQuery resources
Adds data discovery and classification support for the Azure Germany North region
Adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Safety & Societal Impacts Risk, LLM Security Risk, LLM Reliability Risk, LLM Privacy Risk, Overall LLM Safety Risk, Model Supply Chain Risk, and Open Source License Type filters to Managed Models in AI Inventory
Adds Model Supply Chain Risk and Open Source License Type filters to Unmanaged Model (Hugging Face) in AI Inventory
Adds Access Type, Supply Chain Risks, and License Type filters for AI Tools & Packages in AI Inventory
+9 moreshow less
Adds Model Safety Evaluation Results chart for managed AWS and Azure models in AI Inventory
Adds Risk Assessment Results chart for Hugging Face open-source models in AI Inventory
Adds Package Risk Assessment Results chart for AI packages in cloud accounts or associated with open-source AI models
Changes alert age calculation to start from zero upon generation or reset
Adds AWS, Azure, On-Premises, Snowflake, and Databricks posture policies (e.g., 'AWS Bedrock Knowledge Base containing sensitive data can be accessed by IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. users without MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.', 'Azure storage account containing sensitive file share data is not encrypted with a customer-managed key', 'Snowflake database containing sensitive table data is publicly exposed and can be accessed by users without MFA')
Adds single init command for on-premises scanner OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. and VHD images to automate onboarding and initialization
Adds support for scanning on-premises unmanaged databases (SQL Server, PostgreSQL, Oracle, MySQL) with the on-premises scanner
Adds Logging, Encryption, Public Exposure, Data Retention posture labels for Unmanaged AWS/Azure MongoDB, On-Premises MongoDB, and GCP BigQuery; adds Dormant Identity label for AWS Databricks
Adds GCP BigQuery, On-Premises MongoDB Server, Unmanaged AWS/Azure MongoDB Server, and AWS Bedrock Agent to supported data stores for sensitive data scanning
ZPA adds audit log resource types for Microsegmentation ML recommendations and a zGPU icon indicator for Turbo Mode.
Microsegmentation Namespace, Microsegmentation Recommended Resource Tag, Microsegmentation Resource, Microsegmentation Tag Key, Microsegmentation Tag Namespace Hierarchy, and Microsegmentation Tag Value resource types are now added to Microsegmentation ML recommendation audit logs.
A zGPU visual indicator appears next to the Turbo Mode command in the Isolation Bar when hardware acceleration is enabled on an isolation profile with Turbo Mode.
ZIA adds Claude/Mistral Gen AI prompt support via new API fields and UI configuration, plus pagination for URL filtering rules.
Adds enableClaudePrompt and enableMistralAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in the /advancedUrlFilterAndCloudAppSettings API endpoints to enable Gen AI prompts for Claude and Mistral
Extends UI support for Gen AI prompt configuration to Claude and Mistral generative AI applications via Advanced Policy Settings
Adds page and pageSize query parameters to the GET /urlFilteringRules endpoint for paginated rule retrieval with defaults when unspecified
Exposes GET /ruleLabels/ruleType/{ruleType} endpoint to retrieve rule labels by type and GET urlFilteringRules/count to count URL filtering rules
Increases Firewall Insights Rule Name chart limit to 4,000 rules with selectable increments (500, 1,000, 2,000, 4,000) and shows zero-hit rules in bar/table views
+3 moreshow less
Adds 48-hour, 3-day, 5-day, and 7-day time filters to the Firewall Overview dashboard for rule hit count analysis
Paginates URL Filtering Policy list in UI with 100 rules per page and enables filtering by Rule Label, Name, Order, Description, Action, Location, Group, User, Device, IP Group, URL Categories, and HTTP Header Profile
Supports 64 GB RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. and 3 AV engines per Virtual Service Edge on VMware ESXi, Azure, GCP, Hyper-V, AWS, and AWS with GWLB for large file scanning
ZPA Microsegmentation adds ML tag recommendations, Application Catalog, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. dynamic criteria, and multi-subnet network segments.
Adds Tag Management > Application Catalog view in Microsegmentation to list applications used for ML tag generation
Enables Auto-Tagging with ML recommendations for resources based on flow behavior in Microsegmentation
Adds CIDR and IP address ranges as dynamic criteria options in Add Resource Group > Criteria > Dynamic Membership > Environment
Allows up to 64 LAN IP addresses and subnets per Network segment in VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. for Legacy Apps
ZIA adds last modified/shared user fields to SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights logs and NSS Feeds for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. visibility
Adds Last Modified User and Last Shared User filters, plus Last Shared On column to SaaS Security Insights logs page
Adds %s{last_edit_user}, %s{last_share_user}, and %s{last_shared_on} fields to NSS Feed Output Format for SaaS Security logs
Client Connector 4.5.0.508 adds tunnel PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file download and FQDN subdomain bypass options.
Adds the ability to download the forwarding PAC file through the tunnel when in Tunnel mode instead of directly
Updates VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass to optionally not bypass subdomains for FQDNs
ZIA adds Last Modified/Shared User fields to SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights logs and NSS feed formats for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. tracing.
Adds Last Modified User and Last Shared User filters to the SaaS Security Insights page
Adds Last Modified User, Last Shared User, and Last Shared On columns to the Assets With Incidents view
Adds %s{last_edit_user}, %s{last_share_user}, and %s{last_shared_on} fields to NSS Feed Output Format
Zscaler AEM adds GitHub Repositories connector and ServiceNow CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. outegration.
Adds GitHub Repositories connector for limited availability to ingest repository metadata, branch selection, and organization custom properties.
Adds ServiceNow CMDB outegration for limited availability to facilitate updates to Configuration Management Database records including adding missing assets.
ZIA adds enableClaudePrompt and enableMistralAIPrompt API fields for Gen AI prompt categorization in ZIA.
Adds enableClaudePrompt and enableMistralAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model, allowing configuration of generative AI prompts for Claude and Mistral via the /advancedUrlFilterAndCloudAppSettings API.
Extends Zscaler's Gen AI prompt configuration capability to cover Claude and Mistral generative AI applications for categorization and storage.
ZPA adds Microtenant support for Private Service Edges and updated RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. images.
Adds hosting of ZPA Private Service Edges and Private Cloud Controllers within each Microtenant to enhance business continuity.
Updates ZPA Private Service Edge OVA images for Nutanix and VMware platforms to support Red Hat Enterprise Linux 9, automated OS security updates, and OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment.
Adds AWS sublocation scopes (VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Endpoint, VPC, Account, Namespace) for ZIA policy lookup and logging.
Supports configuring scope as part of sublocation criteria in the Cloud & Branch Connector Admin Portal to group workload traffic by VPC Endpoint, VPC, Account, or Namespace within an AWS account.
Resource Approvers allow delegation of JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. access approvals to designated Groups on a per-Resource basis.
Adds the ability to configure one or more Groups as Resource Approvers for any Resource, enabling non-Admin users to review and approve JIT Access Requests.
Nebula v1.10.0 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. overlay support, a new v2 certificate format, packet marking for iptables/nftables, ECMP for unsafe_routes, and PKCS11PKCS11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. P256 key support.
└──▷ GET THIS VERSION
$ git clone --branch v1.10.0 https://github.com/slackhq/nebula.git
# already have the repo? check out this version:$ git checkout v1.10.0
└──▷ USE IT
Ensure unsafe_routes firewall rules still match after the default_local_cidr_any change by explicitly declaring local_cidr in each rule.
yaml
# In nebula config.yml firewall section
firewall:
inbound:
- port: any
proto: any
group: trusted
local_cidr: 10.20.0.0/24
Supports IPv6 and multiple IPv4/IPv6 addresses in the overlay network.
Introduces a new v2 ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses..1-based certificate format with a unified interface for external implementations.
Adds packet marking on Linux to better target Nebula packets in iptables/nftables rules.
Adds ECMP (Equal-Cost Multi-Path) support for unsafe_routes.
Adds PKCS11 support for P256 keys when built with the pkcs11 tag.
+4 moreshow less
Accepts encrypted CA passphrase from an environment variable.
Allows handshaking with any trusted remote.
Allows library users with userspace networking to configure the logger and build version.
Logs a warning when a firewall rule contains an any that negates a more restrictive filter.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!default_local_cidr_any now defaults to false — firewall rules targeting unsafe_routes entries must explicitly declare the destination via the local_cidr field, or traffic that previously matched will no longer match.
Adds file/syslog logging and HTTP client auto-retry to shadowsocks-rust v1.24.0
└──▷ GET THIS VERSION
$ git clone --branch v1.24.0 https://github.com/shadowsocks/shadowsocks-rust.git
# already have the repo? check out this version:$ git checkout v1.24.0
Adds support for logging to a file and syslog via logging configuration keys.
Enables the HTTP client to automatically retry when a cached connection is lost.
Termius v2025 adds SSH.id keys, Multiplayer terminal sharing, workspace state restore, and PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. KEX support.
Introducing SSH.id — device-bound, biometric-protected SSH keys you can provision anywhere using your SSH.id handle
Added host icons for Rocky, Alma, Alpine, and Amazon Linux
Enhanced session log management: save selected logs to prevent overwrites and add comments
Local terminals can be saved in workspace templates
Two new terminal themes introduced: Flexoki Dark and Light
+6 moreshow less
Support for ANSI OSC 52 for better copy-paste experience in the terminal
Updates now need to be initiated manually; auto-update removed
New Multiplayer (Terminal Sharing) with enhanced UX, control management, split view support, and participant list
Added support for the mlkem512-sha256, mlkem768-sha256, and mlkem1024-sha384 key exchange (KEX) methods
Added support for search in session logs
Running snippets on multiple hosts is now free
11 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed auto-update to new versions; updates now need to be initiated manually.
Adds tctl ability to update existing Azure OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. integrations and a new Workload Identities UI page.
└──▷ GET THIS VERSION
$ git clone --branch v17.7.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.7.11
Adds ability to update existing Azure OIDC integration with tctl
Adds a Workload Identities page to the web UI to list workload identitiesworkload identitiesAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials.
Teleport v18.5.0 adds Kubernetes relay support, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. PATCH, and improved EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. discovery
└──▷ GET THIS VERSION
$ git clone --branch v18.5.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.5.0
Adds Kubernetes connectivity support to the Relay Service, allowing it to facilitate connections to Kubernetes clusters.
Introduces SCIM PATCH operations for SailPoint integrations, improving reliability of bulk identity synchronization via the Teleport SCIM server.
Enables discovery of EC2 instances in all regions without requiring enumeration, utilizing the account.ListRegionsIAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permission.
Allows Azure resource discovery to authenticate using Azure OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. integrations instead of traditional credentials.
Configures GOMEMLIMIT to default to 90% of configured memory limits in teleport-cluster, teleport-kube-agent, and teleport-relay Helm charts to reduce OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process.-Killed risk.
Adds --roles flag to tsh request search, User Details view in Web UI, and Azure OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. update via tctl
└──▷ GET THIS VERSION
$ git clone --branch v18.4.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.4.2
Adds --roles flag for tsh request search, allowing users to list all requestable roles.
Added ability to update existing Azure OIDC integration with tctl.
Aembit adds S3 upload support and multiple AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. providers in a single Access Policy
Agent Proxy now supports transparent AWS S3 file uploads with automatic detection of signing methods via the x-amz-content-sha256 header.
Streaming signed payload uploads default to a 50 MiB limit, configurable with AEMBIT_AWS_MAX_BUFFERED_PAYLOAD_BYTES.
Access Policy now supports multiple AWS STS Credential Providers matched automatically using Access Key ID selectors.
SPIRE v1.14.0 adds Azure IMDS node attestation, AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. key tagging, ec-p384 curve support, and expanded docker/GCP capabilities.
└──▷ GET THIS VERSION
$ git clone --branch v1.14.0 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.14.0
└──▷ USE IT
Disable JWT-SVIDJWT-SVIDA SPIFFE Verifiable Identity Document encoded as a JSON Web Token, used to prove workload identity across trust boundaries where X.509 certificates are impractical, such as HTTP headers. issuance on a server that only needs X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. SVIDs, reducing attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
hcl
server {
disable_jwt_svids = true
}
Validate plugin configuration before deploying changes to a live SPIRE server.
New azure_imds node attestor plugin attests nodes running in Microsoft Azure using the Azure Instance Metadata Service (IMDS).
AWS KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key manager plugin now supports key tagging.
JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-SVID profile on spire-server can now be disabled via the disable_jwt_svids config option.
spire-server validate now supports validating plugin configuration.
Adds support for the ec-p384 curve in the workload_x509_svid_key_type configuration option in spire-agent.
+4 moreshow less
Docker workload attestor now supports the docker:image_config_digest selector.
GCP CAs now specify a certificate_id in CreateCertificateRequest for Enterprise tier compatibility.
GCP cloudsql-proxy can now be used with PostgreSQL.
KeyManager directory is now validated to exist and be writeable on agent startup.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The deprecated retry_rebootstrap agent config option has been removed; any working configuration using it will break on upgrade.
Risk Ledger adds direct search and multi-party path tracing on network maps with External Monitoring for unaccepted connections.
└──▷ HOW TO FIND IT
Filter the visual network map to isolate high-risk suppliers based on their data handling characteristics.
📍In the network map, use the filter dropdowns to select Criticality: High and PII: Yes.
View the external security posture of a supplier who has not yet accepted your connection request.
📍Go to Basic Connections and select an Unclaimed Profile to view available scan findings for public domains.
Trace upstream dependencies to identify concentration risk in your fourth-party suppliers.
📍Click on a fourth-party node in the map and select Trace path back to visualize the connection to your organisation.
Adds the ability to search for specific organisations directly from the network map.
Enables tracing the path from any nth-party back to your organisation within the visualisation.
Introduces filtering options for Criticality, Confidentiality, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., custom Labels, and network depth on both own and community maps.
Allows viewing scan findings for publicly available domains on Unclaimed Profiles and Basic Connections before a supplier accepts a connection request.
Sends notifications with supplier details and instructions when connection request emails bounce.
CISO Assistant v3.9.0 adds ServiceNow integration, ISO-objective-to-custom-metric linking, and extended audit result visibility controls.
└──▷ GET THIS VERSION
$ git clone --branch v3.9.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.9.0
Adds ServiceNow integration for bi-directional workflow connectivity between CISO Assistant and ServiceNow.
Supports extended audit result output and an extra flag to control the visibility of progress in audit views.
Links ISO objectives to custom metrics, enabling traceability from compliance objectives to measurable indicators.
Improves metric instances table with enhanced unit management.
4 details in Everything
9 more releases in this issue
· 2025-12-01 → 2025-12-30
CISO Assistant v3.8.1 adds security exception observations, EBios RM strategic scenario filtering, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Excel import support.
└──▷ GET THIS VERSION
$ git clone --branch v3.8.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.8.1
└──▷ HOW TO FIND IT
Document the rationale behind a security exception decision in the UI
📍1. Navigate to the Security Exceptions view.
2. Open or create an exception record.
3. Locate the new observation text field and enter your rationale.
Filter an EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. analysis to examine risk treatment for a specific threat
📍1. Open your existing EBIOS RM study.
2. In the Strategic Scenario section, use the new control panel to select a specific feared event.
3. The view will update to show only controls and impacts relevant to that event.
Import an existing risk management study from an Excel file (Pro feature)
📍1. Go to EBIOS RM › Studies.
2. Click Import.
3. Select your ARM Excel format file.
4. Confirm the import to populate the study with risks and controls.
Adds an observation field to security exceptions for documenting rationale
Enables focusing on specific feared events within EBIOS RM strategic scenarios
Adds pro-only support for importing EBIOS RM studies from ARM Excel format
CISO Assistant v3.8.0 adds custom KPIs/KRIs, task export to XLSX, and a unified library model view.
└──▷ GET THIS VERSION
$ git clone --branch v3.8.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.8.0
└──▷ HOW TO FIND IT
Export a task list to XLSX for sharing progress with stakeholders outside the platform.
📍In the Tasks view, click Export and select XLSX to download the task list as a spreadsheet.
Adds custom KPI and KRI definitions, enabling teams to track bespoke key performance and risk indicators.
Exports tasks as XLSX spreadsheets for offline reporting and stakeholder distribution.
Unifies library model tables into a single consolidated view across frameworks.
CISO Assistant v3.7.10 adds ISO 42001-2023, India's DPDPA 2023, and SCF mappings as new framework support.
└──▷ GET THIS VERSION
$ git clone --branch v3.7.10 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.10
feat(lib): outline for ISO 42001-2023
feat(lib): add India's DPDPA 2023
feat(lib): add SCF mappings and other associated fixes
Adds domain import wizard, applied controls table view, processing export, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server tasks/audits, ref_id in tasks review, and risk matrix switching.
└──▷ GET THIS VERSION
$ git clone --branch v3.7.8 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.8
└──▷ HOW TO FIND IT
Configure or inspect domain imports using the new wizard functionality through the UI.
📍Go to Domains › Import Wizard in the main navigation.
Adds import wizard for domains to streamline bulk domain ingestion.
Enables viewing applied controls in a sortable, filterable table mode instead of card views.
Introduces processing export capability for exporting processing activities data.
Exposes MCP server capacities for interacting with tasks and audits programmatically.
Adds ref_id field to tasks displayed on the aggregated tasks review screen.
+1 moreshow less
Allows switching between different risk matrices directly within risk assessments and EBIOS-RM studies.
CISO Assistant v3.7.7 adds policy validations and improves incident tracking
└──▷ GET THIS VERSION
$ git clone --branch v3.7.7 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.7
└──▷ HOW TO FIND IT
Enforce validation rules on your compliance policies within the application interface.
📍Navigate to Policies in the UI and configure the new validation settings for a specific policy.
Utilize the enhanced incident tracking features to manage security events more effectively.
📍Go to Incidents in the UI and use the improved tracking interface to log and update incidents.
CISO Assistant v3.7.6 adds a pre-delete sanity check to prevent accidental data loss.
└──▷ GET THIS VERSION
$ git clone --branch v3.7.6 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.6
Adds a sanity_check phase before deleting items in the UI
CISO Assistant v3.7.5 adds evidence support in processes, domain-type filtering, and a CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. function switch context menu
└──▷ GET THIS VERSION
$ git clone --branch v3.7.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.5
Adds the ability to attach evidences directly to processings
Adds the domain_type column to the domains table with filtering support
Adds a context menu to switch the CSF function for an applied control
CISO Assistant v3.7.4 adds reverse links from assets to controls and risk scenarios, plus IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access./CBQ/PMBOOK role permissions.
└──▷ GET THIS VERSION
$ git clone --branch v3.7.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.4
Adds setting to enable/disable the warning on external links in the application settings
Adds reverse link to controls on assets, allowing navigation from an asset directly to its associated controls
Adds reverse links to risk scenarios on assets, enabling direct access to risk scenarios linked to a specific asset
Adds iam, crq and pmbok permissions to the roles configuration
Adds more attributes to risk scenarios in the data model
CISO Assistant v3.7.3 introduces a new UI for managing feature flags
└──▷ GET THIS VERSION
$ git clone --branch v3.7.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.3
feat: new UI for feature flags by @melinoix in https://github.com/intuitem/ciso-assistant-community/pull/2978
Drata adds native TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. framework support with pre-mapped VDA ISA controls
Adds TISAX (Trusted Information Security Assessment Exchange) framework as a supported compliance standard
Pre-maps VDA ISA catalog controls to Drata's control library for streamlined implementation
Drata adds ISO/IEC 27018:2025ISO/IEC 27018:2025An ISO/IEC standard specifying privacy controls for public cloud providers that process personal data, giving cyber tools a recognized compliance baseline for handling PII in cloud environments. framework support as an add-on to ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. in public cloud services.
Adds ISO/IEC 27018:2025 as a new compliance framework available as an add-on to ISO 27001
Updates control structure and terminology for the new framework to align with ISO/IEC 27002:2022
Includes Annex B mapping and backward-compatibility guidance for transition from the 2019 edition
Drata enhances Microsoft 365 connectivity by allowing identity mapping via Primary Email or UPN.
Updated Microsoft 365 and GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy. Identity Provider connections to allow explicit control over user identity mapping fields (Primary Email or UPN).
Introduces Custom Workflows allowing automation of GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. tasks via flexible assignment, dynamic personalization, and third-party webhooks.
Adds Custom Workflows feature to automate repetitive GRC tasks like tracking events and following up with users
Enables flexible assignment options in workflows, allowing recipients to be targeted by roles or responsibilities rather than static user names
Allows dynamic personalization of task descriptions and notifications using event-level variables
Supports triggering third-party application workflows via webhooks
Scrut Agent adds automated diagnostics for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., firewall and connectivity checks with enhanced logging
Adds diagnostics that automatically check VPN configuration, firewall settings and internet connectivity on install and every 3 days.
Enables on-demand diagnostic triggers via the UI Run Diagnostics Again button.
New vulnerability scans show the count and list of scanned resources; scans completed before this release do not have this data.
Adds scanned-resource counts and lists to Vulnerabilities > Targets > Target Details for scans completed after this feature release; older scans do not have this data.
Adds effort estimates (High/Medium/Low) to tests, policies, and evidence tasks for prioritization
Displays effort estimates for tests, policies, and evidence; default tags currently cover select frameworks such as ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., and HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against..
Users can sort or filter tasks by the new effort tags (High, Medium, Low).
Individual effort estimates can be adjusted by clicking into an artifact and editing the Effort Estimate field.
Bulk editing of effort estimates is now supported for multiple selected items simultaneously.
New evidence or policies created by users can include an effort estimate upon creation.
Scrut adds automatic sequential Policy IDs with custom prefixes for audit traceability
Enables automatic, sequential numbering of policies via a toggle in Policy Settings, allowing a custom prefix (up to 10 alphanumeric characters) before the system-assigned sequence.
Displays assigned Policy IDs in a new mandatory column in the policy table and on policy detail pages.
Does not reuse IDs from deleted policies while Policy IDs are enabled; disabling the feature permanently removes all assigned Policy IDs.
Adds support for TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. v6.0.3 framework with controls for Prototype Protection, Data Protection, and High Protection
New framework: TISAX v6.0.3 is now available on Scrut
Scrut introduces HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance.CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. e1 framework support, enabling organizations to assess foundational security and privacy controls with a 1-year review cycle. Users can now manage controls, assign owners, and generate readiness reports directly within the Frameworks module.
Scrut adds support for the HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance.CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. i1 framework
Vanta adds CSV export columns for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. answers, experimental Security Assessment Agent, and per-channel Slack auto-reply configuration
CSV exports for TPRM Security Assessments now include AI answer, Vendor answer, and Flagged Findings columns to improve transparency during reviews
1 detail in Everything
2 more releases in this issue
· 2025-12-07 → 2025-12-27
Vanta adds segment-based asset pages, Kolide MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integration, privacy data inventory automation, and issue querying via Vanta Agent
/computers, /access, and /vulnerabilities pages now use Business Unit Segments for asset visibility filtering.
Automated Test for Data Inventory in Privacy Frameworks provides continuous monitoring of data inventory state, replacing document-based tests.
Vanta Agent now supports natural language queries for issue metadata (counts, trends, ownership, statuses).
First-party Vanta-built Kolide MDM integration replaces third-party version with device group filtering and multi-OS support.
QAuto Quick-Add feature allows direct addition of questionnaire responses to the Answer Library.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Draft state for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. reviews is removed; simplified status model (Not Started, In Progress, Complete) is now in effect.
Runlayer is an MCP gateway that enforces identity-mapped permissions and detects threats across the agents and MCP servers employees use.
Runlayer 1.13.1 adds permission warnings, ToolGuard area details, CLI pull, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. catalog updates.
Users now see a warning before connecting an MCP client if they lack the necessary permissions
Security violations now show the specific area of concern that triggered the detection
Added Pulumi and Parallel Search to the MCP catalog
New pull command for downloading runlayer.yaml deployment configurations in the CLI
New optional MCP caching setting for tools/list requests to improve performance
+1 moreshow less
Increased rate limit to 1000 requests/hour for OAuth client registrations
6 details in Everything
1 more release in this issue
· 2025-12-02 → 2025-12-05
Runlayer 1.12.0 adds a visual audit log query builder, security alert emails for admins, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. catalog integrations.
Adds a visual Query Builder UI for filtering Audit Logs
Enables configurable Security Alert Email notifications for workspace administrators
Adds Grain, Fireflies, Iterable, Box, and Contentful to the MCP catalog
Portkey Backend v1.6.1 adds Guardrails config keys, new providers, and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. parsing fixes
Adds guardrails configuration schema with tools (blockedTypes, allowedTypes, blockedFunctionNames, allowedFunctionNames) and params (blockedKeys, allowedKeys, values) sub-keys to control request filtering
Adds Javelin, Qualifire, and Walled as new plugin providers
Updates /spans endpoint aggregate metrics to include total tokens count
Portkey Frontend 1.5.5 adds embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG./completion support, prompt copy, and new guardrail/plugin UI
Added embedding text and completion support on getting started and model integrations
Added copy option on Prompt Playground on Each messages
Portkey Enterprise Gateway v1.17.7 adds Blocked Tools guardrail, Redis ClusterRedis ClusterA distributed mode of Redis, the open-source in-memory data store, that automatically shards data across multiple nodes and keeps it available if some nodes fail, giving cyber tools low-latency shared state at scale. discovery, and semantic cache config env vars.
REDIS_CLUSTER_ENDPOINTS, REDIS_CLUSTER_DISCOVERY_URL, REDIS_CLUSTER_DISCOVERY_AUTH, and REDIS_CLUSTER_DISCOVERY_REFRESH_INTERVAL environment variables support dynamic Redis cluster discovery and static configuration
SEMANTIC_CACHE_EMBEDDING_DIMENSIONS environment variable allows setting custom embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. dimensions for the semantic cache (default: 1536)
New Blocked Tools guardrail plugin adds function, web_search_preview, web_search, file_search, code_interpreter, computer_use, and mcp tool type blocking via blocklists or allowlists
Adds file_upload_failed and batch_start_failed statuses for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway batch jobs.
file_upload_failed status indicates the batch job failed to upload the file to the provider after validation
batch_start_failed status indicates the file upload succeeded but the batch job submission to the provider failed
Enterprise Gateway 1.17.5 adds SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. protection, configurable vector similarity metrics, and provider auth via query params.
Added request validation to prevent Server-Side Request Forgery (SSRF) attacks via configuration URLs
Added configurable similarity metric support for Milvus and Pinecone vector storesvector storesA database built to store embeddings and find the nearest ones to a query quickly. It is the retrieval half of most RAG systems. in Semantic Cache (COSINE, L2, IP)
Added support for provider authentication via query parameters in the Realtime API (e.g., model=@provider/model)
Set span.kind = SERVER on exported OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. spans
Promptfoo tests, evaluates, and red-teams LLM applications to detect vulnerabilities and compare model outputs.
New video and voice providers, OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. tracing, --extension flag, and GPT-5.2 support added to Promptfoo CLI.
Adds OpenAI Sora and Google Veo as new video generation providers
Adds xAI Voice Agent and ElevenLabs as new audio/voice providers
Adds support for the gpt-5.2 model in the GPT-5 series
Adds native OTLP tracing with GenAI semantic conventions via Protobuf support
Adds --extension CLI flag to load extensions via command line after initialization
+11 moreshow less
Adds ability to generate shareable URLs from the Node.js evaluate() API
Adds Wildcard prompt filters allowing wildcards when filtering prompts in the UI
Displays total evaluation duration in the web UI during evaluations
Shows complete grading prompts directly in the UI for inspection
Adds OAuth authentication with proactive token refresh via MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials. provider
Adds interactive team selection during the login flow
Adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing support in Hydra and IterativeMeta components
Adds Multi-modalMulti-modalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. layer strategy to chain audio and image attacks in test strategies
Updates Browser provider to support multi-turn session persistence
Adds configurable numberOfResults for Bedrock Knowledge Base queries
Adds F1 score metric to evaluate tool callingtool callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. accuracy with Enterprise Assertions
AI-Infra-Guard v3.5.0 adds dynamic analysis framework, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. remote tool invocation, and new detection types
└──▷ GET THIS VERSION
$ git clone --branch v3.5.0 https://github.com/Tencent/AI-Infra-Guard.git
# already have the repo? check out this version:$ git checkout v3.5.0
Adds Dynamic Analysis Framework with specialized agents for malicious behavior and vulnerability testing
Adds tool poisoning detection and rug pull detection capabilities
Adds support for new evaluation datasets including copyright-violation, misinformation, privacy-leakage, unethical-behavior, violent, and non-violent-illegal-activity
Adds mcp_tool for remote MCP server tool invocation
Adds write_file tool for file writing operations
+4 moreshow less
Adds version router endpoint /version via the Version API
Adds prompt_manager utility for prompt template management
Adds custom MCP Header Support for authentication and protocol configuration
Adds frontend integration for MCP scan header configuration in the settings panel
9 details in Everything
0 more releases in this issue1 more release in this issue · 2025-12-04 → 2025-12-26
New MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-Scan framework, headless screenshot capabilities, and advanced encoding/obfuscation attack methods in AI-Infra-Guard v3.5-preview
└──▷ GET THIS VERSION
$ git clone --branch v3.5-preview https://github.com/Tencent/AI-Infra-Guard.git
# already have the repo? check out this version:$ git checkout v3.5-preview
Adds MCP-Scan framework for Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. security scanning with autonomous agent-based code audit and vulnerability review
Adds support for 12+ new encoding/obfuscation attack methods including A1Z26, AffineCipher, AsciiSmuggling, Aurebesh, Caesar, Leetspeak, MirrorText, Ogham, Vaporwave, Zalgo, Stego, and StrataSword suite
Adds Chromium-based headless screenshot functionality for web scanning
Adds core health monitoring infrastructure for vmcp backends
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.18 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.18
20 more releases in this issue
· 2025-12-01 → 2025-12-23
Adds CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. fields for vmcp audit config
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.88 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.88
Adds CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. fields for vmcp audit config in the ToolHive Operator
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.17 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.17
Adds audit fields to the VMCP CRD spec to configure audit logging
ToolHive v0.6.15 adds OAuth/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth config fields to the MCPRegistry CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.15 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.15
ToolHive v0.0.86 adds OAuth/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth fields to MCPRegistry CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.86 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.86
Adds OAuth/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth config fields to the MCPRegistry CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.15 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.15
Adds oauth and oidc configuration blocks to the MCPRegistryCustom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for enabling authentication.
Adds PostgreSQL pgpass file support to the MCPRegistry operator
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.85 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.85
ToolHive Operator adds PostgreSQL pgpass support via Helm chart
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.13 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.13
ToolHive operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. v0.0.84 adds structured content support for composite tools
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.84 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.84
ToolHive v0.6.12 adds configurable scopes for auth, audit middleware to vMCP server, composite tool ref resolution, and reusable K8s secrets/configmaps.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.12 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.12
Adds scopes field to VirtualMCPServerCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. configuration
Adds unauthenticated and header-injection auth strategies to MCPExternalAuthConfig
Wires configurable scopes to the vMCP CLI via the auth info handler
Implements CompositeToolRefs resolution in VirtualMCPServer converter
Adds audit middleware to vMCP server with backend routing capture
+3 moreshow less
Adds reusable Kubernetes secrets functionality in Operator
Adds reusable Kubernetes configmap functionality in Operator for C/R/U actions
Enables MCPRemoteProxy discovery in MCPGroup and VirtualMCPServer
ToolHive operator adds reusable Kubernetes ConfigMap support and wires audit config through vMCP CLI.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.82 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.82
Adds reusable Kubernetes ConfigMap functionality in the operator for Create/Read/Update (C/R/U) actions
Adds reusable Kubernetes secrets and scopes field for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. in ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.81 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.81
Adds a scopes field to the MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. to configure OIDC settings
Enables reusable Kubernetes secrets functionality within the Operator
Adds crds.install.* feature flags and default keep policy for ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. Helm chart
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.80 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.80
└──▷ TRY IT
Install only the server CRDs when deploying the operator via Helm.
Adds crds.install.server, crds.install.registry, and crds.install.virtualMcp feature flags to selectively install CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. groups
Annotates CRDs with helm.sh/resource-policy: keep by default, controlled via the crds.keep config key
2 details in Everything
└──▷ BREAKING ON UPGRADE
!CRDs have moved from crds/ to templates/, meaning Helm will now upgrade them on subsequent releases instead of leaving stale versions after installation
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. add configurable scopes to auth info handler exposed via CLI
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.79 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.79
Add --auth-scope flag (and related scope configuration) to the ToolHive operator CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. CLI for filtering or specifying authentication contexts
ToolHive Operator 0.5.11 adds Helm chart support and workload warnings for secret changes
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.11 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.11
Warns users about affected workloads when updating or deleting secrets
ToolHive v0.0.77 adds unauthenticated and header-injection auth strategies to MCPExternalAuthConfig
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.77 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.77
unauthenticated and headerinjection added as valid values for the auth_strategy field in MCPExternalAuthConfig
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. v0.0.75 adds log level config, auth file injection, and CompositeToolRefs support
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.75 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.75
Adds logLevel configuration support to VirtualMCPServer resources for dynamic runtime logging control
Add build-time authentication file injection capability to protocol tool builds via new internal paths
ToolHive v0.6.10 adds Zed client support, PVC source for MCPRegistry, and Output Schema Support to CompositeToolSpec CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.10 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.10
└──▷ USE IT
Connect ToolHive to a Zed editor instance using the new supported client type.
shell
toolhive run --client zed
Adds client_secret_env optional field in vMCP OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. config to allow omitting the secret for certain providers
Makes client_id optional in vMCP OIDC config, simplifying configuration for identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. that do not require a client ID
Adds PVC source support for MCPRegistry via the PVCSource type in the registry server
Adds Output Schema Support to CompositeToolSpec CRD, enabling schema definitions for composite tool outputs
Adds Zed editor integration as a supported client type for ToolHive
ToolHive Operator adds PVC source for MCPRegistry and output schema support to CompositeToolSpec.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.73 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.73
Adds pvc as a supported source type for MCPRegistry, allowing tool definitions to be loaded from a PersistentVolumeClaim
Adds outputSchema field to the CompositeToolSpecCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., enabling structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. validation for composed tools
Adds LangChain 1.x support with content blocks API and benchmarking scripts
└──▷ GET THIS VERSION
$ git clone --branch v0.19.0 https://github.com/NVIDIA-NeMo/Guardrails.git
# already have the repo? check out this version:$ git checkout v0.19.0
langchain v1 compatibility is now supported in NeMo Guardrails.
Adds llm provider support for LangChain 1.x content blocks to handle reasoning traces and tool calls.
Adds a Procfile to run Guardrails with mock LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for benchmarking.
Adds an AIPerf run script for benchmarking workflows.
Zenity discovers, secures and governs enterprise AI agents from buildtime to runtime across SaaS, endpoint and cloud.
Zenity releases Safe Harbor, an open-source wrapper for OpenAI, Anthropic, and Gemini clients that adds a built-in safe action for agents to abort unsafe workflows.
Adds Safe Harbor wrapper for OpenAI, Anthropic, or Google Gemini clients to provide agents with a dedicated safe action for aborting malicious instructions
Zenity adds detection and governance for agentic browsers like ATLAS, Comet, and Dia.
Adds automatic discovery of agentic browsers (ATLAS, Comet, Dia, MCPs) on managed and unmanaged devices.
Enables real-time guardrails to flag or block unauthorized actions by agentic browsers.
Monitors agentic browser behavior for sensitive data leakage including secrets, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly., and PHIPHIProtected Health Information: individually identifiable health data regulated under the US HIPAA law, whose strict handling requirements drive cyber tools to audit, mask, or restrict access to it..
Obsidian Mobile v1.11.0 adds iOS/Android widgets, Siri/shortcuts integration, and plugin location API.
Adds iOS Lock Screen, Control Center, and Home Screen widgets for actions including Create a note, Open specific note, Open daily note, Open search, and Capture to a note.
Adds iOS Shortcuts that allow appending or prepending text to a note via Capture shortcuts without opening the Obsidian app.
Adds iOS Siri integration with voice commands such as Capture using Obsidian, Capture to Obsidian, Open my daily note in Obsidian, and Search in Obsidian.
Adds Android widgets for Open Note, New Note, Search, Daily Note, and Open Obsidian, allowing multiple instances configured by long-press.
Adds Android Quick Settings Tile (requires Android 7.0+) and new shortcuts accessible via long-pressing the app icon or search bar.
+1 moreshow less
Allows plugin developers to request user location through a new API, enabling features like Maps.
goshs 1.1.3 adds invisible mode and makes mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. opt-in
└──▷ GET THIS VERSION
$ git clone --branch 1.1.3 https://github.com/patrickhener/goshs.git
# already have the repo? check out this version:$ git checkout 1.1.3
New invisible mode hides the server from passive observers on the network
mDNS advertisement is now opt-in instead of opt-out, reducing unintended network exposure by default
2 details in Everything
└──▷ BREAKING ON UPGRADE
!mDNS is now opt-in instead of opt-out — existing setups that relied on mDNS being enabled by default will no longer advertise unless the opt-in flag is explicitly set
Coreinfo gains a GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.; NotMyFault adds Arm64 support; Process Explorer enables the Assemblies tab for .NET processes.
└──▷ TRY IT
Crash a Windows system via the HalTimerWatchdogTriggerSystemReset method to test watchdog reset behavior on Arm64 hardware.
Kali Linux 2025.4 introduces GNOME 49 with Wayland default, bpf-linker, evil-winrm-py, hexstrike-ai, and NetHunter Android 16 support
└──▷ TRY IT
Launch the Halloween-themed desktop overlay from the command line.
$ kali-undercover --halloween
Adds Kali Halloween Mode accessible via kali-undercover --halloween to dress the desktop for the occasion.
Introduces GNOME 49 as the default desktop environment with Wayland as the only supported window server (X11 removed).
Updates KDE PlasmaKDE PlasmaA desktop environment for Linux and other Unix-like systems, maintained by the KDE community, giving cyber tools a full graphical shell and widget toolkit to build native GUI applications against. to version 6.5, adding fuzzy matching in KRunner, flexible window tiling, and an improved screenshot tool.
Adds color theme customization support for Xfce desktop via qt5ct or qt6ct for Qt programs and the Appearance application.
Enables VM guest utils (clipboard sharing, window scaling) for Wayland in VirtualBox, VMware, and QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware..
+7 moreshow less
Distributes the Kali Live image exclusively over BitTorrent due to size exceeding HTTP CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. limits (>5 GB).
Adds bpf-linker as a new package for BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. static linking.
Adds evil-winrm-py as a new Python-based tool for executing commands on remote Windows machines via WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS..
Adds hexstrike-ai as a new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server allowing AI agents to autonomously run tools.
Updates Kali NetHunter to support Android 16 and adds device support for Samsung Galaxy S10 series (LineageOS 23) and OnePlus Nord.
Refreshes Kali NetHunter Terminal app to support any Magisk version with interactive mode and adds Wifipumpkin3 tab preview.
Adds four new Kali mirrors: India (mirrors.esto.network), South Korea (mirror2.keiminem.com, mirror.eliv.digital), and USA (mirror.us.cdn-perfprod.com).
12 details in Everything
└──▷ BREAKING ON UPGRADE
!GNOME 49 removes X11 session support; Wayland is now the default and only window server.
!Kali Live image is no longer available via HTTP download; it is distributed over BitTorrent only.
Agents SDK v0.3.0 adds dynamic tool approval via needsApproval and server-side tool() definition for human-in-the-loophuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. workflows
Adds the needsApproval option to the server-side tool() function to conditionally require user confirmation for agent tools.
Introduces the unified tool() function on the server, replacing the client-side AITool pattern for defining agent capabilities.
Adds the onToolCall callback parameter to useAgentChat(options) to handle client-side tool execution and output.
Adds support for sending files and images to Workers AI models via the file part type in messages, with automatic conversion by the provider.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The CoreMessage type has been removed; use ModelMessage instead.
!The mode option for generateObject has been removed and must be omitted from the call signature.
!The convertToModelMessages() function is now asynchronous; all calls must now await the result.
Cloudflare Terraform provider v5.15 adds ai_search resource and new attributes for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./Gateway/List resources.
Adds ai_search resource to support AI Search endpoints
Adds forensic_copy attribute to zero_trust_gateway_policy resource
Supports category, location, and device types in zero_trust_list resource
Adds startup_time_ms attribute to worker_version resource
Adds upload_status attribute to zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, and zero_trust_dlp_predefined_entry resources
R2 Data Catalog now supports automatic snapshot expiration for Iceberg tables via wrangler CLI.
Adds the new subcommand npx wrangler r2 bucket catalog snapshot-expiration enable to configure automatic retention policies for Apache IcebergApache IcebergAn open table format for large analytic datasets, maintained by the Apache Software Foundation, that gives cyber tools reliable schema evolution, time-travel queries, and atomic commits on object storage or HDFS. table snapshots.
Introduces --older-than-days <N> and --retain-last <N> CLI arguments to define which snapshots are eligible for removal.
Wrangler adds wrangler auth token command to retrieve current authentication credentials for scripts and other tools.
└──▷ USE IT
Get the current auth token in a script for use with other tools.
shell
wrangler auth token
Retrieve structured JSON output to determine token type and values programmatically.
shell
wrangler auth token --json
Adds the wrangler auth token command which retrieves the currently configured authentication token or credentials, prioritizing API token from CLOUDFLARE_API_TOKEN then OAuth token from wrangler login.
Adds --json flag to wrangler auth token for structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. including token type (api_token, oauth, api_key) and associated values like key/email.
Wrangler 4.55 adds --x-autoconfig flag and wrangler setup command for automatic framework configuration
└──▷ USE IT
Deploy a framework or static site to Cloudflare Workers with automatic configuration instead of manual adapter installation.
shell
npx wrangler deploy --x-autoconfig
Adds the --x-autoconfig flag to npx wrangler deploy to automatically configure and deploy supported frameworks (Next.js, Astro, Nuxt, TanStack Start, SolidStart, React Router, SvelteKit, Docusaurus, Qwik, Analog) and static sites without manual setup.
@cloudflare/vitest-pool-workers now supports ctx.exports API for accessing top-level Worker exports in tests.
Adds support for the ctx.exports API via createExecutionContext() in @cloudflare/vitest-pool-workers to access a Worker's top-level exports during unit testing
Enables importing exports directly from the cloudflare:workers module within tests
R2 SQL adds aggregation functions (COUNT, SUM, etc.) and schema discovery commands to wrangler.
Adds GROUP BY support for aggregating data across dimensions in R2 SQL queries.
Adds HAVING clause support to filter aggregated results in R2 SQL.
Adds new SQL aggregation functions (COUNT, SUM, AVG, MIN, MAX) for Apache IcebergApache IcebergAn open table format for large analytic datasets, maintained by the Apache Software Foundation, that gives cyber tools reliable schema evolution, time-travel queries, and atomic commits on object storage or HDFS. tables in R2 Data Catalog.
Adds the SHOW DATABASES and SHOW NAMESPACES metadata commands to list available namespaces.
Adds the SHOW TABLES IN namespace_name command to list tables within a specific namespace.
+1 moreshow less
Adds the DESCRIBE namespace_name.table_name command to view table schema and column types.
Pay Per Crawl adds Discovery API for domain discovery, crawler-error header, free page rules, and payment header signing
Adds the GET https://crawlers-api.ai-audit.cfdata.org/charged_zones endpoint to programmatically discover domains participating in Pay Per Crawl.
Allows site owners to configure free pages via Rules > Configuration Rules by setting URI patterns on URI Full and enabling the Disable Pay Per Crawl setting.
WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds two new generic detections for server-side function exposure and resource exhaustion.
Adds Generic - Server Function Source Code Exposure detection (Rule ID ...74746aff) to the Cloudflare Free Ruleset with a Block action
Adds Generic - Server Function Resource Exhaustion detection (Rule ID ...102ec699) to the Cloudflare Managed Ruleset in Disabled state
Wrangler config now optional for assets-only sites via Vite plugin, generating defaults automatically
wrangler.toml, wrangler.json, and wrangler.jsonc are now optional when using the Cloudflare Vite plugin for assets-only (static) sites; if none are found the plugin generates sensible defaults
Default name is derived from package.json or the project directory name
Default compatibility_date uses the latest date supported by your installed Miniflare version
wrangler dev now supports direct remote database connections via localConnectionString config and env vars
wrangler dev now connects directly to remote databases and those requiring TLS without the --remote flag.
Adds localConnectionString field to Hyperdrive bindings in wrangler configuration to specify remote connection details for local development.
Introduces CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_<BINDING_NAME> environment variable as an alternative way to configure the local connection string.
Emergency WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. release blocks RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via unsafe deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. with two new managed rulesets.
Deploys Cloudflare Managed Ruleset rule ID ...5fb92fba to block the RCE Generic - Framework vulnerability.
Deploys Cloudflare Free Ruleset rule ID ...99702280 to block the same RCE vulnerability for free-tier accounts.
Arcade 2025-12-12 adds OAuth for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, multi-org CLI support, and Google Drive/contacts toolkits.
Adds OAuth authentication configuration for arcade-mcp servers
Enables running multiple uvicorn workers for arcade-mcp servers
Includes type annotations in the arcade_mcp_server module
Supports specifying multiple organizations and projects via Arcade CLI flags
Adds phone number support in Google contacts toolkits
+1 moreshow less
Enables file download and upload operations to Google Drive
6 details in Everything
1 more release in this issue
· 2025-12-05 → 2025-12-12
Arcade adds GitHub/Ashby/Linear toolkits, email invites, CLI endpoints, and startup warnings for missing secrets.
Add tools for project management, pull request, and projects to the Github MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface.
THE CYBER TOOLCHAIN